9.8Kritik
CVE-2023-54342Eclipse Equinox OSGi 3.8-3.18 Console Remote Code Execution
Açıklama
Eclipse Equinox OSGi versions 3.8 through 3.18 contain a remote code execution vulnerability in the console interface that allows unauthenticated attackers to execute arbitrary code by exploiting the fork command functionality. Attackers can establish a telnet connection to the OSGi console, perform a telnet handshake, and send fork commands to download and execute malicious Java code, establishing a reverse shell connection.
Zayıflık türü (CWE):
CWE-306
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| eclipse | equinox | 3.8 – ≤ 3.18 | |
| Eclipse | Equinox OSGi | 3.8 – ≤ 3.18 |
Kaynaklar ve yamalar
- ExploitDB-51878 exploit
- VulnCheck Advisory: Eclipse Equinox OSGi 3.8-3.18 Console Remote Code Execution third-party-advisory