PT-2018-11211 · Ocs · Ocs Inventory Ng

Juan Manuel Fernandez · Publicado 2018-08-03 · Atualizado 2018-10-02 · CVE-2018-12483

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions OCS Inventory version 2.4.1

Description The issue is a remote command-execution problem. It happens because the content of the ipdiscover analyser rzo GET parameter is concatenated to a string used in an exec() call in the PHP code. To exploit this, authentication is required.

Recommendations For OCS Inventory version 2.4.1, consider restricting access to the ipdiscover analyser module to minimize the risk of exploitation. Avoid using the rzo parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2018-12483

Produtos afetados

Ocs Inventory Ng

Referências · 9

• 🔥 https://tarlogic.com/en/blog/vulnerabilities-in-ocs-inventory-2-4-1 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-12483 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-12483 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12483 · Nota
• https://security-tracker.debian.org/tracker/CVE-2018-12483 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-12483 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-12483 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-12483 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-12483 · Nota de Segurança