CVE-2018-6926

HighCVSS 7.2/10Last modified Jun 22, 2026

Description

In app/Controller/ServersController.php in MISP 2.4.87, a server setting permitted the override of a path variable on certain Red Hed Enterprise Linux and CentOS systems (where rh_shell_fix was enabled), and consequently allowed site admins to inject arbitrary OS commands. The impact is limited by the setting being only accessible to the site administrator.

Metrics

CVSS 3.0 7.2/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Feb 12, 2018
Last modified: Jun 22, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-69277.8The futex_requeue function in kernel/futex.c in the Linux kernel before 4.14.15 might allow attackers to cause a denial of service (integer CVE-2018-69289.8PHP Scripts Mall News Website Script 2.0.4 has SQL Injection via a search term.CVE-2018-69306.5A stack-based buffer over-read in the ComputeResizeImage function in the MagickCore/accelerate.c file of ImageMagick 7.0.7-22 allows a remot CVE-2018-69348.8CSRF exists in student/personal-info in PHP Scripts Mall Online Tutoring Script 2.0.3.CVE-2018-69355.4PHP Scripts Mall Student Profile Management System Script v2.0.6 has XSS via the Name field to list_student.php.CVE-2018-69365.4Cross Site Scripting (XSS) exists on the D-Link DIR-600M C1 3.01 via the SSID or the name of a user account.CVE-2018-69406.1A /shell?cmd= XSS issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in c CVE-2018-69418.8A /shell?cmd= CSRF issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in CVE-2018-69426.5An issue was discovered in FreeType 2 through 2.9. A NULL pointer dereference in the Ins_GETVARIATION() function within ttinterp.c could lea CVE-2018-69436.1core/lib/upload/um-image-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails CVE-2018-69446.1core/lib/upload/um-file-upload.php in the UltimateMember plugin 2.0 for WordPress has a cross-site scripting vulnerability because it fails CVE-2018-69477.8An uninitialised stack variable in the nxfuse component that is part of the Open Source DokanFS library shipped with NoMachine 6.0.66_2 and