PT-2018-13622 · Kaizen · Kaizen Asset Manager+1

Publicado 2018-09-05 · Atualizado 2019-10-03 · CVE-2018-16545

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kaizen Asset Manager (Enterprise Edition) (affected versions not specified) Kaizen Training Manager (Enterprise Edition) (affected versions not specified)

Description The issue allows a remote attacker to achieve arbitrary code execution via file impersonation. This can be done by assuming the identity of a temporary file, for example, by making a malicious dynamic-link library (dll) impersonate a temporary (tmp) file, such as isxdl.dll, or by making an executable file impersonate a temporary file, such as 996E.temp.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2018-16545

Produtos afetados

Kaizen Asset Manager

Kaizen Training Manager

Referências · 3

• 🔥 https://github.com/GitHubAssessments/CVE_Assessment_03_2018/blob/master/Kaizen_Report.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-16545 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-16545 · Aviso do Fabricante