Description
The restricted shell provided by Akkadian Provisioning Manager Engine (PME) can be escaped by abusing the 'Edit MySQL Configuration' command. This command launches a standard vi editor interface which can then be escaped. This issue was resolved in Akkadian OVA appliance version 3.0 (and later), Akkadian Provisioning Manager 5.0.2 (and later), and Akkadian Appliance Manager 3.3.0.314-4a349e0 (and later).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Akkadian | Provisioning Manager Engine (PME) | 4.50.18 – ≤ 4.50.18 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Akkadian Provisioning Manager - Information Disclosure http/cves/2021/CVE-2021-31581.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.