PT-2008-6008 · Plain Black · Webgui

Publicado 2008-10-30 · Atualizado 2017-08-08 · CVE-2008-4798

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WebGUI versions prior to 7.5.30

Description The issue allows remote attackers to execute arbitrary code by uploading a Perl module and accessing it via a crafted URL, specifically through the loadModule function in lib/WebGUI/Asset.pm.

Recommendations For versions prior to 7.5.30, update to version 7.5.30 or later to resolve the issue. As a temporary workaround, consider restricting access to the loadModule function in lib/WebGUI/Asset.pm to minimize the risk of exploitation.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2008-4798

Produtos afetados

Webgui

Referências · 8

• http://webgui.org/uploads/70/o2/70o29CTLCGWjntJrLYdmJA/asset-security-7.4.diff · Nota
• http://vupen.com/english/advisories/2008/2944 · Nota
• http://secunia.com/advisories/32438 · Aviso do Fabricante
• http://webgui.org/getwebgui/advisories/webgui-7.5.30-stable-released · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46137 · Nota
• http://webgui.org/bugs/tracker/8980 · Nota
• http://securityfocus.com/bid/31947 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2008-4798 · Nota de Segurança