{"id":"CVE-2019-25029","aliases":["EUVD-2019-11479","GHSA-288v-wgqw-xcfp"],"status":"published","title":"In Versa Director, the command injection is an attack in which the goal is execution of arbitrary...","description":"In Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02403,"percentile":0.84162,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-77"],"published":"2021-05-26T18:45:32Z","modified":"2026-08-31T18:31:01Z","products":[{"vendor":"versa networks","product":"versa director"},{"vendor":"versa-networks","product":"versa_director"}],"references":[{"url":"https://hackerone.com/reports/1168198","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-25029"},{"url":"https://github.com/advisories/GHSA-288v-wgqw-xcfp"}],"sources":{"cve":[{"id":"CVE-2019-25029","description":"In Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation.","status":"published","published":"2021-05-26T18:45:32Z","modified":"2024-08-05T03:00:18.786Z","cwes":["CWE-77"],"updated_at":"2026-11-02T14:20:19.737165Z"}],"euvd":[{"id":"EUVD-2019-11479","description":"In Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation.","status":"published","published":"2021-05-26T18:45:32Z","modified":"2024-08-05T03:00:18Z","updated_at":"2026-11-03T02:40:20.270172Z"}],"ghsa":[{"id":"GHSA-288v-wgqw-xcfp","title":"In Versa Director, the command injection is an attack in which the goal is execution of arbitrary...","description":"In Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation.","status":"published","published":"2022-05-24T19:03:18Z","modified":"2026-08-31T18:31:01Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:11:11.297642Z"}],"nvd":[{"id":"CVE-2019-25029","description":"In Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation.","status":"published","published":"2021-05-26T19:15:08.773Z","modified":"2026-08-31T18:08:14.137Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:05:48.502374Z"}]}}