CVE-2024-28114

Peering Manager is a BGP session management tool. There is a Server Side Template Injection vulnerability that leads to Remote Code Execution in Peering Manager <=1.8.2. As a result arbitrary commands can be executed on the operating system that is running Peering Manager. This issue has been addressed in version 1.8.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-74

• https://github.com/peering-manager/peering-manager/commit/8a865fb596c11ad7caf45aef317d8fcbce7f85ffPatch
• https://github.com/peering-manager/peering-manager/security/advisories/GHSA-q37x-qfrx-jcv6Exploit, Vendor Advisory
• https://owasp.org/www-community/attacks/Command_InjectionNot Applicable
• https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/07-Input_Validation_Testing/18-Testing_for_Server_Side_Template_InjectionNot Applicable
• https://stackoverflow.com/questions/73939573/how-to-sanitise-string-of-python-code-with-pythonNot Applicable
• https://github.com/peering-manager/peering-manager/commit/8a865fb596c11ad7caf45aef317d8fcbce7f85ffPatch
• https://github.com/peering-manager/peering-manager/security/advisories/GHSA-q37x-qfrx-jcv6Exploit, Vendor Advisory
• https://owasp.org/www-community/attacks/Command_InjectionNot Applicable
• https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/07-Input_Validation_Testing/18-Testing_for_Server_Side_Template_InjectionNot Applicable
• https://stackoverflow.com/questions/73939573/how-to-sanitise-string-of-python-code-with-pythonNot Applicable

Published

Mar 12, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-28109veraPDF-library is a PDF/A validation library. Executing pol…8.1
• CVE-2024-2811A vulnerability was found in Tenda AC15 15.03.20_multi and c…9.8
• CVE-2024-28110Go SDK for CloudEvents is the official CloudEvents SDK to in…7.5
• CVE-2024-28111Canarytokens helps track activity and actions on a network. …6.5
• CVE-2024-28112Peering Manager is a BGP session management tool. Affected v…4.8
• CVE-2024-28113Peering Manager is a BGP session management tool. In Peering…6.1
• CVE-2024-28115FreeRTOS is a real-time operating system for microcontroller…7.8
• CVE-2024-28116Grav is an open-source, flat-file content management system.…8.8
• CVE-2024-28117Grav is an open-source, flat-file content management system.…8.8
• CVE-2024-28118Grav is an open-source, flat-file content management system.…8.8
• CVE-2024-28119Grav is an open-source, flat-file content management system.…8.8
• CVE-2024-2812A vulnerability was found in Tenda AC15 15.03.05.18/15.03.20…8.8