Vulnerability · Published Jul 22, 2021 · Assigned by rapid7
CVE-2021-31580Akkadian Provisioning Manager Engine (PME) Shell Escape via 'exec' command
High 8.7
In plain English
A high-severity OS command injection in Provisioning Manager Engine (PME) from Akkadian. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.0% (higher than 88% of all known vulnerabilities).
Official description
The restricted shell provided by Akkadian Provisioning Manager Engine (PME) can be bypassed by switching the OpenSSH channel from `shell` to `exec` and providing the ssh client a single execution parameter. This issue was resolved in Akkadian OVA appliance version 3.0 (and later), Akkadian Provisioning Manager 5.0.2 (and later), and Akkadian Appliance Manager 3.3.0.314-4a349e0 (and later).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Akkadian | Provisioning Manager Engine (PME) | 4.50.18 – through 4.50.18 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N