8.4Yüksek
CVE-2025-13444OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster
Açıklama
OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters
Zayıflık türü (CWE):
CWE-78
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| progress | connection manager for objectscale | < 7.2.62.2 | |
| progress | ecs connection manager | < 7.2.62.2 | |
| Progress Software | LoadMaster | 7.2.50 – < V7.2.62.2, 7.2.50 – < V7.2.54.16 | |
| progress | moveit web application firewall | 7.2.62.1 | |
| progress | multi-tenant hypervisor | < 7.1.35.15 | |
| Progress Software | Multi Tenant LoadMaster | 7.2.39 – < V7.1.35.15 |
Kaynaklar ve yamalar
- https://community.progress.com/s/article/LoadMaster-Vulnerabilities-CVE-2025-13444-CVE-2025-13447 vendor-advisoryVendor Advisory
- https://community.progress.com/s/article/ECS-Connection-Manager-Vulnerabilities-CVE-2025-13444-CVE-2025-13447 vendor-advisoryVendor Advisory
- https://community.progress.com/s/article/Connection-Manager-for-ObjectScale-Vulnerabilities-CVE-2025-13444-CV… vendor-advisoryVendor Advisory
- https://community.progress.com/s/article/MOVEit-WAF-Vulnerabilities-CVE-2025-13444-CVE-2025-13447 vendor-advisoryVendor Advisory
CPE eşleşmeleri (NVD) (6)
cpe:2.3:a:progress:connection_manager_for_objectscale:*:*:*:*:*:*:*:*< 7.2.62.2cpe:2.3:a:progress:ecs_connection_manager:*:*:*:*:*:*:*:*< 7.2.62.2cpe:2.3:a:progress:moveit_web_application_firewall:7.2.62.1:*:*:*:*:*:*:*cpe:2.3:a:progress:multi-tenant_hypervisor:*:*:*:*:*:*:*:*< 7.1.35.15cpe:2.3:o:progress:loadmaster:*:*:*:*:*:*:*:*< 7.2.54.16cpe:2.3:o:progress:loadmaster:*:*:*:*:*:*:*:*≥ 7.2.55.0 < 7.2.62.2