PT-2016-7498 · Moxa · Softcms

Gu Ziqiang + 1 · Publicado 2016-11-23 · Atualizado 2017-02-17 · CVE-2016-8360

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Moxa SoftCMS versions prior to 1.6

Description A specially crafted URL request sent to the SoftCMS ASP Webserver can cause a double free condition on the server, allowing an attacker to modify memory locations and possibly cause a denial of service or the execution of arbitrary code.

Recommendations For versions prior to 1.6, update to version 1.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the ASP Webserver to minimize the risk of exploitation. Avoid using specially crafted URL requests in the affected ASP Webserver until the issue is resolved.

Correção

Double Free

Enumeração de Fraquezas

CWE-415

Identificadores relacionados

CVE-2016-8360

ZDI-16-615

Produtos afetados

Softcms

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2016-8360 · Nota de Segurança
• http://securityfocus.com/bid/94394 · Nota
• https://zerodayinitiative.com/advisories/ZDI-16-615 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-8360 · Aviso do Fabricante
• https://ics-cert.us-cert.gov/advisories/ICSA-16-322-02 · Nota