CyberRota Analysis
AI-GeneratedAn OS command injection vulnerability in the log rotation configuration of Liman server management software allows authenticated administrators to execute arbitrary commands on the server due to improper sanitization of the `ip_address` parameter. This critical flaw, which can lead to complete system compromise, should be prioritized by organizations using affected versions of Liman, particularly those with administrative access to the software. Users are strongly advised to upgrade to version 2.2.2 - 1103 or later to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log rotation configuration endpoint allows an authenticated administrator to execute arbitrary operating system commands on the Liman server. The `ip_address` parameter is embedded directly into a shell command without sanitization, enabling shell escape via single-quote injection. This is fixed in 2.2.2 - 1103.