CVE Vulnerabilities

CVE-2017-5799

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Published: Feb 15, 2018 | Modified: Mar 15, 2018
CVSS 3.x
8.8
HIGH
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
6.5 MEDIUM
AV:N/AC:L/Au:S/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

A Remote Code Execution vulnerability in HPE OpenCall Media Platform (OCMP) was found. The vulnerability impacts OCMP versions prior to 3.4.2 RP201 (for OCMP 3.x), all versions prior to 4.4.7 RP702 (for OCMP 4.x).

Weakness

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Affected Software

Name Vendor Start Version End Version
Opencall_media_platform Hp 3.0.0 (including) 3.4.2 (excluding)
Opencall_media_platform Hp 4.0.0 (including) 4.4.7 (excluding)

Potential Mitigations

References