Description
Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations. A malicious or compromised legacy tar-installed client selected for upgrade or patching may be able to cause commands to be executed on the BoKS Master during client version handling.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Fortra | Core Privileged Access Manager (BoKS) | boks-server 8.1.0.0 – ≤ boks-server 8.1.0.22, boks-server 9.0.0.0 – ≤ boks-server 9.0.0.4 | — |