PT-2018-10722 · Dialogic · Dialogic Powermedia Xms

Publicado 2018-07-03 · Atualizado 2018-09-05 · CVE-2018-11638

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Dialogic PowerMedia XMS versions prior to 3.5

Description The issue allows remote authenticated users to upload malicious code to the web root, resulting in code execution. This is due to the unrestricted upload of files with dangerous types in the administrative console.

Recommendations For versions prior to 3.5, update to version 3.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the administrative console to minimize the risk of exploitation.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2018-11638

Produtos afetados

Dialogic Powermedia Xms

Referências · 3

• 🔥 https://d3adend.org/blog/?p=1398 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-11638 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-11638 · Aviso do Fabricante