PT-2018-13954 · Nmap · Nmap4J

Zhutougg · Publicado 2018-09-19 · Atualizado 2019-10-03 · CVE-2018-17228

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions nmap4j version 1.1.0

Description The issue allows attackers to execute arbitrary commands via shell metacharacters in an includeHosts call.

Recommendations For nmap4j version 1.1.0, consider restricting the use of the includeHosts call until a patch is available to prevent the execution of arbitrary commands.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2018-17228

Produtos afetados

Nmap4J

Referências · 3

• 🔥 https://github.com/narkisr/nmap4j/issues/9 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-17228 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-17228 · Aviso do Fabricante