CVE-2020-13124: SABnzbd 2.3.9 and 3.0.0Alpha2 has a command injection vulnerability in the web configuration interface that permits an authenticated user to execute arbitrary…

PriorityP259high8.8CVSS 3.1

AVNACLPRLUINSUCHIHAH

EPSS

4.63%

90.5th percentile

SABnzbd 2.3.9 and 3.0.0Alpha2 has a command injection vulnerability in the web configuration interface that permits an authenticated user to execute arbitrary Python commands on the underlying operating system.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
debian	sabnzbdplus	< sabnzbdplus 3.1.1+dfsg-1 (bookworm)	sabnzbdplus 3.1.1+dfsg-1 (bookworm)
sabnzbd	sabnzbd	—	—
sabnzbd	sabnzbd	—	—

Detection & IOCsextracted from sources · hover to see the quote

→Vulnerable versions of SABnzbd are 2.3.9 and 3.0.0Alpha2; monitor for these specific version strings in asset inventories or HTTP banners ↗
→Exploitation requires authentication; monitor SABnzbd web configuration interface for unusual Python command execution or unexpected child processes spawned by the SABnzbd process ↗

·Exploitation is scoped as local (authenticated access required); attack surface is limited to users with valid credentials to the SABnzbd web configuration interface ↗
·Fixed in SABnzbd version 3.1.1; Debian packages resolved in 3.1.1+dfsg-1 across bookworm, bullseye, forky, sid, and trixie ↗

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P

osv8.8HIGH

vendor_debian8.8HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.