In Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host operating system…

Description

In Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation.

Scores

EPSS (exploitation in 30 days)

2.4% · top 16% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.

Weakness

• CWE-77: Command Injection - Generic (CWE-77) (opens in a new tab)All about CWE-77 and its CVEs

Affected products

• Versa Director

  • affected Fixed Versions: 16.1R2S11, 20.2.2, 21.1.1, 21.2.1

References (1)

• https://hackerone.com/reports/1168198 (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2019-25029](https://trackcve.app/badge/CVE-2019-25029.svg)](https://trackcve.app/cve/CVE-2019-25029)

Record last updated 5 Aug 2024, 03:00 UTC.