OpenDCIM 23.04
Approved changes feed: RSS · Atom
cpe:2.3:a:opendcim:opendcim:23.04:*:*:*:*:*:*:*part: a version: 23.04 update: *
| Vendor | Opendcim (476a95bc-3cf5-50b7-a422-7af2186f1d11) |
|---|---|
| Product | Opendcim (632638da-87a3-5e4f-a5c9-6af762ce375f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/opendcim/opendcim |
purl2cpe | 2026-06-01 10:14:43.108782 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-28517 |
vulnerable | 2026-06-08 07:55:15.408527 |
openDCIM <= 23.04 OS Command Injection via dot Configuration Parameter
openDCIM version 23.04, through commit 4467e9c4, contains an OS command injection vulnerability in report_network_map.php. The application retrieves the 'dot' configuration parameter from the database and passes it directly to exec() without validation or sanitization. If an attacker can modify the fac_Config.dot value, arbitrary commands may be executed in the context of the web server process.
Published: 2026-02-27T22:12:08.889Z
Updated: 2026-11-08T14:01:47.084Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28516 |
vulnerable | 2026-06-08 07:55:15.407908 |
openDCIM <= 23.04 SQL Injection in Config::UpdateParameter
openDCIM version 23.04, through commit 4467e9c4, contains a SQL injection vulnerability in Config::UpdateParameter. The install.php and container-install.php handlers pass user-supplied input directly into SQL statements using string interpolation without prepared statements or proper input sanitation. An authenticated user can execute arbitrary SQL statements against the underlying database.
Published: 2026-02-27T22:11:52.246Z
Updated: 2026-11-08T14:01:46.217Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-28515 |
vulnerable | 2026-06-08 07:55:15.407329 |
openDCIM <= 23.04 Missing Authorization in install.php
openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php. The installer and upgrade handler expose LDAP configuration functionality without enforcing application role checks. Any authenticated user can access this functionality regardless of assigned privileges. In deployments where REMOTE_USER is set without authentication enforcement, the endpoint may be accessible without credentials. This allows unauthorized modification of application configuration.
Published: 2026-02-27T22:11:37.303Z
Updated: 2026-11-08T14:01:45.469Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.