Red Hat 'redhat-ds-admin' Shell Command Injection and Security Bypass Vulnerabilities

Red Hat 'redhat-ds-admin' Shell Command Injection and Security Bypass Vulnerabilities

The 'redhat-ds-admin' application is prone to a command-injection issue and security-bypass issues that affect the Administration Server.

Attackers with access to the replication monitor web page can exploit the command-injection issue to execute arbitrary shell commands with the privileges of the Administration Server. Remote unauthenticated attackers can use the security-bypass vulnerabilities to access potentially sensitive information or perform certain unauthorized actions.

Note that combining the vulnerabilities would allow remote unauthorized attackers to execute arbitrary code with the privileges of the Administration Server.

NOTE: In default configurations, the Administration Server runs as unprivileged user 'nobody'.

These issues affect 'redhat-ds-admin' used with Red Hat Directory Server 8.