PT-2018-13422 · Opsview · Opsview Monitor

Publicado 2018-09-05 · Atualizado 2019-10-03 · CVE-2018-16144

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Opsview Monitor versions prior to 5.3.1 Opsview Monitor versions 5.4.x prior to 5.4.2

Description The issue arises from improper sanitization of the rancid password parameter in the test connection functionality of the NetAudit section, leading to command injection.

Recommendations For versions prior to 5.3.1, update to version 5.3.1 or later. For versions 5.4.x prior to 5.4.2, update to version 5.4.2 or later.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2018-16144

Produtos afetados

Opsview Monitor

Referências · 6

• 🔥 https://seclists.org/fulldisclosure/2018/Sep/3 · Exploit
• 🔥 https://coresecurity.com/advisories/opsview-monitor-multiple-vulnerabilities · Exploit
• https://knowledge.opsview.com/v5.3/docs/whats-new · Aviso do Fabricante
• https://knowledge.opsview.com/v5.4/docs/whats-new · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-16144 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-16144 · Nota de Segurança