Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

  1. Reconshell
  2. Vulnerabilities (CVE)
Filtered by vendor Aerospike Subscribe
Filtered by product Aerospike Server
Total 1 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2020-13151 1 Aerospike 1 Aerospike Server 2023-01-27 10.0 HIGH 9.8 CRITICAL
Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions (UDFs), written in Lua, as part of a database query. It attempts to restrict code execution by disabling os.execute() calls, but this is insufficient. Anyone with network access can use a crafted UDF to execute arbitrary OS commands on all nodes of the cluster at the permission level of the user running the Aerospike service.