PT-2018-11494 · Seeddms · Seeddms

Publicado 2018-07-31 · Atualizado 2018-09-28 · CVE-2018-12939

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SeedDMS versions prior to 5.1.8

Description A directory traversal flaw allows an authenticated attacker to write to or potentially delete arbitrary files by using a .. (dot dot) in the "qquuid" parameter of the "op/op.UploadChunks.php" endpoint. This can be leveraged to execute arbitrary code.

Recommendations For versions prior to 5.1.8, update to version 5.1.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the "op/op.UploadChunks.php" endpoint or disabling the qquuid parameter to minimize the risk of exploitation.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-12939

Produtos afetados

Seeddms

Referências · 4

• https://osv.dev/vulnerability/CVE-2018-12939 · Aviso do Fabricante
• https://sourceforge.net/p/seeddms/code/ci/seeddms-5.1.x/tree/CHANGELOG · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2018-12939 · Nota de Segurança
• https://contextis.com/resources/advisories/cve-2018-12939 · Correção