Sign in Sign up
JA · EN · FR
SecPulse

Cwe 78

🧬 CWE Related 2,028
slug: cwe-78

Explanation

CWE-78は「ユーザー入力をシェルコマンドの一部として使うとき、適切にエスケープせず、攻撃者がコマンドを追加実行できてしまう欠陥」のことです。 例えば `ping {ユーザー入力IP}` の {ユーザー入力IP} に `; rm -rf /` のような文字列を入れられると、サーバー上のファイルが削除されます。 対策は「シェル経由を避け、引数を配列として直接渡す (PHPなら escapeshellarg)」。
📌 Example
Shellshock (CVE-2014-6271): Bashの脆弱性で、Webサーバーへの普通のリクエスト経由で任意のシェルコマンドが実行できた歴史的な事件。
🔗 Related links

🔖 Related tags

Cwe 798692 Cwe 894154 Cwe 8624040 Cwe 2844030 Cwe 4163898 Cwe 1193185 Cwe 2003145 Cwe 1253116 Cwe 202857 Cwe 222773 Cwe 7872520 Cwe 941871 Cwe 8631869 Cwe 1221801 Cwe 741796

🛡 Vulnerabilities tagged with this 2,028

Image ID Title
CVE-2021-1488 Command Injection in Cisco Adaptive Security Appliance (ASA) Software (CVE-2021-1488)
CVE-2021-21345 Code Injection in com.thoughtworks.xstream:xstream (CVE-2021-21345)
CVE-2020-27575 OS Command Injection in Maxum Rumpus (CVE-2020-27575)
CVE-2020-26259 OS Command Injection in com.thoughtworks.xstream:xstream (CVE-2020-26259)
CVE-2020-26217 OS Command Injection in com.thoughtworks.xstream:xstream (CVE-2020-26217)
CVE-2020-7712 OS Command Injection in Oracle Joyent (CVE-2020-7712)
CVE-2020-15778 OS Command Injection in OpenSSH (CVE-2020-15778)
CVE-2020-3167 OS Command Injection in Cisco FXOS Software (CVE-2020-3167)
CVE-2019-12699 Vulnerability in Cisco FXOS Software (CVE-2019-12699)
CVE-2019-1959 Vulnerability in Cisco Enterprise NFV Infrastructure Software (CVE-2019-1959)
CVE-2019-1960 Vulnerability in Cisco Enterprise NFV Infrastructure Software (CVE-2019-1960)
CVE-2013-7285 OS Command Injection in Oracle Activemq (CVE-2013-7285)
CVE-2019-1709 OS Command Injection in Cisco Firepower Threat Defense (FTD) Software (CVE-2019-1709)
CVE-2018-0453 Vulnerability in Cisco Firepower Threat Defense (FTD) sensors (CVE-2018-0453)
CVE-2018-6926 OS Command Injection in Misp Project (CVE-2018-6926)
CVE-2014-8389 OS Command Injection in Airlive (CVE-2014-8389)
CVE-2017-17888 OS Command Injection in Anti-Web (CVE-2017-17888)
CVE-2017-17411 OS Command Injection in Linksys (CVE-2017-17411)
CVE-2017-5255 OS Command Injection in Cambiumnetworks (CVE-2017-5255)
CVE-2017-15049 OS Command Injection in Zoom (CVE-2017-15049)
CVE-2017-17757 OS Command Injection in Tp Link Tl Wvr450L Firmware (CVE-2017-17757)
CVE-2017-17758 OS Command Injection in Tp Link Tl Wvr450L Firmware (CVE-2017-17758)
CVE-2017-17105 OS Command Injection in Zivif PR115-204-P-RS (CVE-2017-17105)
CVE-2017-15103 OS Command Injection in Heketi Project (CVE-2017-15103)
CVE-2017-10904 OS Command Injection in Qt for Android (CVE-2017-10904)
CVE-2017-17405 OS Command Injection in Ruby (CVE-2017-17405)
CVE-2017-16921 OS Command Injection in OTRS (CVE-2017-16921)
CVE-2017-17458 OS Command Injection in mercurial (CVE-2017-17458)
CVE-2017-17055 OS Command Injection in Artica Web Proxy (CVE-2017-17055)
CVE-2016-1253 OS Command Injection in Most (CVE-2016-1253)

We use cookies for analytics and ad measurement. This setting applies to all Game co., Ltd. sites. Details