PT-2018-11601 · Microsoft+1 · Windows+1

Ben Larkin + 1 · Publicado 2018-07-03 · Atualizado 2019-10-03 · CVE-2018-13101

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RedSwimmer KioskSimple version 1.4.7.0

Description The issue concerns a privilege escalation vulnerability in the WCF endpoint of KioskSimpleService.exe. This vulnerability allows for read and write access to the Windows registry and control of services. An attacker could exploit these exposed methods to execute controlled binaries, leading to privilege escalation.

Recommendations For RedSwimmer KioskSimple version 1.4.7.0, consider restricting access to the WCF endpoint as a temporary mitigation measure until a patch is available. Avoid using the vulnerable methods in the WCF endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2018-13101

Produtos afetados

Kiosksimple

Windows

Referências · 3

• https://github.com/VerSprite/research/blob/master/advisories/VS-2018-026.md · Nota
• https://osv.dev/vulnerability/CVE-2018-13101 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-13101 · Nota de Segurança