PT-2017-17162 · Franklin Fueling Systems · Franklin Fueling Systems Ts-550 Evo

Stick-U235 · Publicado 2017-05-01 · Atualizado 2024-02-14 · CVE-2017-6565

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Franklin Fueling Systems TS-550 evo version 2.3.0.7332

Description The issue allows an attacker to upload malicious files to the server hosting the web service due to the lack of sanitization checks. This can be achieved by exploiting a specific weakness to obtain the roleDiag user credentials.

Recommendations For Franklin Fueling Systems TS-550 evo version 2.3.0.7332, consider restricting file upload capabilities for the roleDiag user until a proper fix is implemented to sanitize uploaded files and prevent malicious payloads.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2017-6565

Produtos afetados

Franklin Fueling Systems Ts-550 Evo

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-6565 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-6565 · Aviso do Fabricante
• http://u235.io/single-post/2017/05/01/Penetrating-Fuel-Management-Systems · Nota
• https://gist.github.com/Stick-U235/b187931f828e92866d09b9bdeb956ca2 · Nota