Vulnerability · Published Feb 24, 2023 · Assigned by TR-CERT
CVE-2021-3855Command Injection in Liman Central Management System
High 8.8
In plain English
A high-severity command injection in Liman Central Management System from Liman Central Management System. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)1.8%top 21.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Liman Central Management System Liman MYS (HTTP/Controllers, CronMail, Jobs modules) allows Command Injection. This issue affects Liman Central Management System: from 1.7.0 before 1.8.3-462.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Liman Central Management System | Liman Central Management System | 1.7.0 – before 1.8.3-462 |
Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://docs.liman.dev/baslangic/guvenlik release-notes
- https://www.usom.gov.tr/bildirim/tr-23-0109 government-resource, broken-link
- https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-23-0109 government-resource