PT-2018-12768 · Ocs Inventory · Ocsinventory-Server

Simon Uvarov · Publicado 2018-08-06 · Atualizado 2018-10-10 · CVE-2018-14857

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OCS Inventory Server versions prior to 2.5

Description The issue allows a privileged user to gain access to the server via a template file containing PHP code. This is due to unrestricted file upload in the require/mail/NotificationMail.php file in Webconsole, where file extensions other than .html are permitted.

Recommendations For versions prior to 2.5, restrict file uploads to only allow .html extensions to prevent remote code execution. As a temporary workaround, consider disabling the file upload feature in the Webconsole until a patch is available.

Correção

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2018-14857

Produtos afetados

Ocsinventory-Server

Referências · 8

• https://github.com/OCSInventory-NG/OCSInventory-ocsreports/commit/cc572819e373f7ff81dec61591b6f465b43c5515 · Nota
• https://security-tracker.debian.org/tracker/CVE-2018-14857 · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2018/Aug/6 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-14857 · Aviso do Fabricante
• http://securitytracker.com/id/1041418 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-14857 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14857 · Nota
• https://osv.dev/vulnerability/CVE-2018-14857 · Aviso do Fabricante