Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-8954: CA Workload Control Center lets attackers run code

CVE-2018-8954 · published 8 years ago

Summary

Versions of CA Workload Control Center prior to the r11.4 SP6 update can be tricked by a specially crafted web request into running any program the attacker chooses. This could let a remote attacker take control of the server that runs the product. Upgrade to r11.4 SP6 or later, or apply the vendor's patch, to close the risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
ca	workload_control_center	<= r11.4 sp1 sp2 sp3 sp4 sp5 `cpe:2.3:a:ca:workload_control_center::::::::`

Original advisory text

CA Workload Control Center before r11.4 SP6 allows remote attackers to execute arbitrary code via a crafted HTTP request.

References

http://www.securityfocus.com/bid/103742 Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1040605 Third Party Advisory VDB Entry
https://support.ca.com/us/product-content/recommended-reading/security-notices/c... Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

7% chance of attack within 30 days

Type

CWE-20Improper Input Validation

Timeline

Published11 Apr 2018

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2018-8954 · NVD

Track software like this

Free during beta