Back
CVE-2018-1000666
CRITICAL
GIG Technology NV JumpScale Portal 7 version before commit 15443122ed2b1cbfd7bdefc048bf106f075becdb contains a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in method: notifySpaceModification; that can result in Improper validation of parameters results in command execution. This attack appear to be exploitable via Network connectivity, required minimal auth privileges (everyone can register an account). This vulnerability appears to have been fixed in After commit 15443122ed2b1cbfd7bdefc048bf106f075becdb.
Published: Sep 6, 2018
Modified: Jun 17, 2026
CWE-78
CVSS Metrics
CVSSv3
Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products (2)
| Vendor | Product | Version |
|---|---|---|
| openvcloud_project | openvcloud | * < 2.3.0 |
| gig | jumpscale | 7 |
GitHub Security Advisory GHSA-vf7g-gwvv-qxxr
GIG Technology NV JumpScale Portal 7 version before commit...
References (10)
- https://github.com/0-complexity/openvcloud/issues/1207 Exploit, Issue Tracking, Third Party Advisory
- https://github.com/jumpscale7/jumpscale_portal/blob/c997bb1824862b08246d60e34e950df06ebac68c/apps/portalbase/system/system__contentmanager/methodclass/system_contentmanager.py#L293-L315 Exploit, Third Party Advisory
- https://github.com/jumpscale7/jumpscale_portal/pull/108 Broken Link
- https://medium.com/%40vrico315/vulnerability-in-jumpscale-portal-7-a88098a1caca
- https://telegra.ph/Description-of-vulnerability-in-JumpScale-Portal-7-08-23 Exploit, Third Party Advisory
- https://github.com/0-complexity/openvcloud/issues/1207 Exploit, Issue Tracking, Third Party Advisory
- https://github.com/jumpscale7/jumpscale_portal/blob/c997bb1824862b08246d60e34e950df06ebac68c/apps/portalbase/system/system__contentmanager/methodclass/system_contentmanager.py#L293-L315 Exploit, Third Party Advisory
- https://github.com/jumpscale7/jumpscale_portal/pull/108 Broken Link
- https://medium.com/%40vrico315/vulnerability-in-jumpscale-portal-7-a88098a1caca
- https://telegra.ph/Description-of-vulnerability-in-JumpScale-Portal-7-08-23 Exploit, Third Party Advisory
Risk Scores
CVSS Score
9.8 / 10
EPSS Score
8.08%
Top 6% most likely to be exploited
Threat Score
41.6 / 100
Data Sources
NVD
EPSS
GitHub