Unscored severity · published May 8, 2014
CVE-2014-2935
costview3/xmlrpc_server/xmlrpc.php in CostView in Caldera 9.20 allows remote attackers to execute arbitrary commands via shell metacharacters in a methodCall element in a PHP…
–
CVSS
4.4%
EPSS
No
On KEV
Description
costview3/xmlrpc_server/xmlrpc.php in CostView in Caldera 9.20 allows remote attackers to execute arbitrary commands via shell metacharacters in a methodCall element in a PHP XMLRPC request.
Exploitation
Is it being used?
Exploit prediction (EPSS)4.4% · higher than 91% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CA
Caldera · Caldera
9.20 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-2935
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-2935
US Government Resource
http://www.kb.cert.org/vuls/id/693092
www.securityfocus.com
http://www.securityfocus.com/bid/67252
More from Caldera
–
CVE-2014-2936
The directory manager in Caldera 9.20 allows remote attackers to conduct variable-injection attacks in the global scope via (1) the maindir_hotfolder parameter to…
–
CVE-2014-2934
Multiple SQL injection vulnerabilities in Caldera 9.20 allow remote attackers to execute arbitrary SQL commands via the tr parameter to (1) costview2/jobs.php or (2)…
–
CVE-2014-2933
Directory traversal vulnerability in dirmng/index.php in Caldera 9.20 allows remote attackers to access arbitrary directories via a crafted pathname