PT-2018-1121 · U.Motion · U.Motion Builder
Publicado
2018-02-02
·
Atualizado
2020-02-03
·
CVE-2018-7777
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
U.motion Builder versions prior to 1.3.4
Description
The issue is due to insufficient handling of the
update file request parameter on the update module.php script in the U.motion Builder software. This allows a remote, authenticated attacker to exploit the vulnerability by sending a specially crafted request to the server, potentially enabling the execution of arbitrary code.Recommendations
For versions prior to 1.3.4, update to version 1.3.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the
update module.php script to minimize the risk of exploitation. Avoid using the update file parameter in the affected API endpoint until the issue is resolved.Exploit
Correção
RCE
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
U.Motion Builder