Copeland XWEB Pro OS Command Injection Vulnerability Allowing Remote Code Execution

A command injection vulnerability has been identified in Copeland XWEB Pro versions through 1.12.1. This vulnerability allows an unauthenticated attacker to execute arbitrary code on the system by sending a crafted request to the libraries installation route, injecting malicious input into the request body.

Impact

Exploitation of this vulnerability could lead to unauthorized command execution on the affected system, allowing an attacker to execute arbitrary code with the same privileges as the application.

Remediation

Copeland has released a patch for this vulnerability. Users are advised to update XWEB Pro to the latest version available. Instructions for updating can be found on the Copeland XWEB Pro System Software Updates page.