PT-2018-13607 · Primx · Prim'X Zed! Free+1

Publicado 2018-09-05 · Atualizado 2018-10-26 · CVE-2018-16518

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Prim'X Zed! FREE versions 1.0 build 186 and earlier Prim'X Zed! Limited Edition versions 6.1 build 2208 and earlier

Description A directory traversal issue allows for remote code execution, enabling the creation of arbitrary files on a user's workstation. This is possible through the use of crafted ZED! containers, which can be used by the watermark loading function to place an executable file into a Startup folder.

Recommendations For Prim'X Zed! FREE version 1.0 build 186 and earlier, consider disabling the watermark loading function until a patch is available. For Prim'X Zed! Limited Edition version 6.1 build 2208 and earlier, restrict access to the Startup folder to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-16518

Produtos afetados

Prim'X Zed! Free

Prim'X Zed! Limited Edition

Referências · 3

• 🔥 https://github.com/ponypot/cve/blob/master/zed_watermarkExtension.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-16518 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-16518 · Aviso do Fabricante