PT-2018-13073 · Ocs Inventory+1 · Ocs Inventory Ng+1

Simon Uvarov · Publicado 2018-11-29 · Atualizado 2019-01-31 · CVE-2018-15537

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OCS Inventory NG (affected versions not specified)

Description The issue allows a privileged user to gain access to the server via crafted HTTP requests, exploiting an unrestricted file upload vulnerability with remote code execution in the ocsreports component.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2018-15537

Produtos afetados

Debian

Ocs Inventory Ng

Referências · 9

• https://security-tracker.debian.org/tracker/CVE-2018-15537 · Aviso do Fabricante
• http://packetstormsecurity.com/files/150330/OCS-Inventory-NG-ocsreports-Shell-Upload.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-15537 · Nota de Segurança
• http://seclists.org/fulldisclosure/2018/Nov/40 · Nota
• https://ubuntu.com/security/CVE-2018-15537 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-15537 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-15537 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-15537 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-15537 · Aviso do Fabricante