The Black Duck blackduck-c-cpp component is vulnerable to OS command injection, which could allow an attacker to gain unauthorized control over the affected system.

This vulnerability is an OS command injection flaw (CWE-78) occurring in the package manager component. It allows an attacker to inject and execute arbitrary commands, requiring local access to the system to exploit the vulnerability.

Successful exploitation allows an attacker to execute arbitrary OS commands, which typically results in a complete compromise of the local system. This level of access can lead to lateral movement, data exfiltration, or the installation of persistent malicious software. With a CVSS score of 7.5, this high-severity issue necessitates prompt remediation to secure the development or build environment where this package is utilized.

Immediate Action: Update the blackduck-c-cpp package to version 3.0.7 or later to resolve the command injection vulnerability.

Proactive Monitoring: Review logs for suspicious command execution patterns or unauthorized process spawning within environments where the package manager is active.

Compensating Controls: Restrict execution permissions for the package manager to authorized users only and ensure that the host environment adheres to the principle of least privilege.

Public Exploit Available: Unknown

The risk posed by OS command injection is severe and warrants immediate action. Developers and security teams should verify their current version of blackduck-c-cpp and upgrade to version 3.0.7 or higher to effectively mitigate this security risk.