CVE-2023-7116 is a critical OS command injection vulnerability affecting WeiYe-Jing datax-web versions up to 2.1.2. An unauthenticated attacker can remotely execute arbitrary operating system commands by manipulating the "processId" argument within the /api/log/killJob endpoint. This vulnerability carries a CVSS score of 9.8 (Critical) due to its network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While not currently listed in CISA KEV, public exploit details are available, and Nuclei templates exist, indicating a high potential for exploitation despite limited community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
2.1.2CPE matchmatch criteria | cpe:2.3:a:datax-web_project:datax-web:2.1.2:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.