CVE-2008-5810

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-01-02 · updated 2026-06-16
Weakness: CWE-20

Description

WBPublish (aka WBPublish.exe) in Fujitsu-Siemens WebTransactions 7.0, 7.1, and possibly other versions allows remote attackers to execute arbitrary commands via shell metacharacters in input that is sent through HTTP and improperly used during temporary session data cleanup, possibly related to (1) directory names, (2) template names, and (3) session IDs.

Affected products

Fujitsu-Siemens Webtransactions: 7.0, 7.1

References

http://bs2www.fujitsu-siemens.de/update/securitypatch.htm#english
http://secunia.com/advisories/33168
http://securityreason.com/securityalert/4856
http://www.sec-consult.com/files/20081219-0_fujitsu-siemens_webta_cmdexec.txt
http://www.securityfocus.com/archive/1/499417/100/0/threaded
http://www.securityfocus.com/bid/32927
http://www.securitytracker.com/id?1021475
http://www.vupen.com/english/advisories/2008/3462
https://exchange.xforce.ibmcloud.com/vulnerabilities/47495
http://bs2www.fujitsu-siemens.de/update/securitypatch.htm#english
http://secunia.com/advisories/33168
http://securityreason.com/securityalert/4856

Get alerted when CVE-2008-5810 or the next vulnerability affects your stack