PT-2018-1307 · Ipswitch · Ipswitch Whatsup Gold

Vyacheslav Moskvin · Publicado 2018-03-22 · Atualizado 2024-08-27 · CVE-2018-8938

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ipswitch WhatsUp Gold versions prior to 18.0

Description A Code Injection issue was discovered in DlgSelectMibFile.asp, related to errors in code generation management. This issue allows malicious actors to inject a specially crafted SNMP MIB file, potentially enabling them to execute arbitrary commands and code on the WhatsUp Gold server.

Recommendations For versions prior to 18.0, update to version 18.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the DlgSelectMibFile.asp component to minimize the risk of exploitation. Avoid using specially crafted SNMP MIB files until the issue is resolved.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

BDU:2018-00805

CVE-2018-8938

Produtos afetados

Ipswitch Whatsup Gold

Referências · 6

• https://community.ipswitch.com/s/article/Externally-Reported-Security-Issues · Nota
• https://docs.ipswitch.com/NM/WhatsUpGold2018/01_ReleaseNotes/index.htm · Aviso do Fabricante
• https://t.me/cvenotify/92364 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2018-8938 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2018-00805 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-8938 · Nota de Segurança