SxDevOps vulnerabilities

A weakness has been identified in SxDevOps versions 1.0 and 1.1 in an unknown function of the file backend/sxdevops/settings.py, leading to information disclosure. The attack can be initiated remotely. A patch named 2b4bf8585c3e731e7a8af30801ea46680bc783f9 is available.

A security flaw has been discovered in aiyiyi121 SxDevOps 1.0/1.1 in the file backend/sxdevops/settings.py of the Settings Handler component. The manipulation results in hard-coded credentials. The attack may be performed remotely. The patch is identified as 2b4bf8585c3e731e7a8af30801ea46680bc783f9.

A vulnerability was identified in aiyiyi121 SxDevOps 1.0/1.1 in the function ensure_default_superuser of the file rbac/services.py. The manipulation leads to hard-coded credentials. The attack is possible remotely. The patch identifier is 2b4bf8585c3e731e7a8af30801ea46680bc783f9.

A vulnerability was found in SxDevOps versions 1.0/1.1 in the update function of backend/rbac/serializers.py, within the UserSerializer component. Input manipulation can lead to improper privilege management, and the attack can be executed remotely. The vendor was notified and quickly released a fixed version (patch 2b4bf8585c3e731e7a8af30801ea46680bc783f9).

A vulnerability was found in SxDevOps versions 1.0 and 1.1 in the generate_host_task function of the file backend/aiops/services.py (Command Handler component). Manipulation of the command argument results in command injection, and the attack can be launched remotely. The patch is named 2b4bf8585c3e731e7a8af30801ea46680bc783f9.

A vulnerability has been found in SxDevOps versions 1.0 and 1.1 in the paramiko.SSHClient.exec_command function of the file backend/ops/host_tasks.py (TASK_RUN_COMMAND component). Manipulation of the command argument leads to command injection, and the attack may be launched remotely. The patch is named 2b4bf8585c3e731e7a8af30801ea46680bc783f9.

A flaw has been found in SxDevOps versions 1.0 and 1.1 in the subprocess.Popen function of the file backend/aiops/services.py (MCP STDIO Server Management component). Manipulation of the endpoint_or_command argument causes command injection, and the attack may be initiated remotely. The patch is named 2b4bf8585c3e731e7a8af30801ea46680bc783f9.