HIGH8.8

GHSA-hhqm-f4m4-pq39

RaspAP raspap-webgui Command Injection vulnerability

Quick fix

GHSA-hhqm-f4m4-pq39 — billz/raspap-webgui: upgrade to the fixed version with the command below.

composer require billz/raspap-webgui:^2.8.9

Details

Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/billz/raspap-webgui

Introduced in: 0Fixed in: 2.8.9

Fixcomposer require billz/raspap-webgui:^2.8.9

References

https://nvd.nist.gov/vuln/detail/CVE-2023-30260[ADVISORY]
https://github.com/RaspAP/raspap-webgui/pull/1322[WEB]
https://github.com/RaspAP/raspap-webgui/commit/238e1670fcef8b18ec4628ee74fc345607536a16[WEB]
https://eldstal.se/advisories/230328-raspap.html[WEB]
https://github.com/RaspAP/raspap-webgui[PACKAGE]