Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
Shrubbery tac_plus 2.x, 3.x. and 4.x through F4.0.4.28 allows unauthenticated Remote Command Execution. The product allows users to configure authorization checks as shell commands through the tac_plus.cfg configuration file. These are executed when a client sends an authorization request with a username that has pre-authorization directives configured. However, it is possible to inject additional commands into these checks because strings from TACACS+ packets are used as command-line arguments. If the installation lacks a a pre-shared secret (there is no pre-shared secret by default), then the injection can be triggered without authentication. (The attacker needs to know a username configured to use a pre-authorization command.) NOTE: this is related to CVE-2023-45239 but the issue is in the original Shrubbery product, not Meta's fork.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Facebook Tacacs+ 安全漏洞
Vulnerability Description
Facebook Tacacs+是美国Facebook公司的一个守护进程库。 Facebook Tacacs+ F4.0.4.28及之前版本存在安全漏洞，该漏洞源于允许用户通过 tac_plus.cfg 配置文件将授权检查配置为 shell 命令。
CVSS Information
N/A
Vulnerability Type
N/A