CVE-2013-3631
NAS4Free 9.1.0.1.804 and earlier allows remote authenticated users to execute arbitrary PHP code via a request to exec.php, aka the "Advanced | Execute Command" feature.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 13.7%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
NAS4Free 9.1.0.1.804 and earlier allows remote authenticated users to execute arbitrary PHP code via a request to exec.php, aka the "Advanced | Execute Command" feature. NOTE: this issue might not be a vulnerability, since it appears to be part of legitimate, intentionally-exposed functionality by the developer and is allowed within the intended security policy.
- CVSS 2.0
- 6.0 MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
- EPSS
- 13.73% probability · 96th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- nas4free/nas4free
- Source
- cret@cert.org
References
- http://www.kb.cert.org/vuls/id/326830US Government Resource
- https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treatsExploit
- http://www.kb.cert.org/vuls/id/326830US Government Resource
- https://community.rapid7.com/community/metasploit/blog/2013/10/30/seven-tricks-and-treatsExploit
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.