Description

OpenX Source v. 2.8.10 (the binary distribution) was compromised, and two of the files were replaced with two new modified files that contained a remote code execution vulnerability. All OpenX downloads since at least November 2012 through August 2013 were affected.

Remediation

Upgrade to OpenX version 2.8.11.

References

Warning: OpenX Ad Server contains a backdoor

Related Vulnerabilities

Remote code execution of user-provided local names in Rails

Reflected Cross-Site Scripting (XSS) vulnerability in PAN-OS management web interface

Drupal Core 8.5.0 Remote Code Execution (8.5.0)

WordPress Plugin Bricks Remote Code Execution (1.9.6)

WordPress Plugin Arigato Autoresponder and Newsletter Remote Code Execution (2.5.1.9)

Severity

High

Classification

CVE-2013-4211 CWE-95 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

Code Execution