PT-2018-14276 · Gigasoft+2 · Gigasoft Charting Package+2

Limingzheng · Publicado 2018-10-10 · Atualizado 2019-10-09 · CVE-2018-17925

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions GE iFIX versions 2.0 through 5.8

Description The issue is related to an Unsafe ActiveX Control Marked Safe For Scripting in a third-party ActiveX object provided by Gigasoft. This vulnerability may be exposed when the Gigasoft charting package is used independently outside the iFIX product. The method that impacts Internet Explorer is not exposed in the iFIX product, and the core functionality of the iFIX product is not known to be impacted.

Recommendations For GE iFIX versions 2.0 through 5.8, consider restricting the use of the Gigasoft charting package outside the iFIX product to minimize the risk of exploitation. As a temporary workaround, avoid using the independent Gigasoft charting package until a patch or fix is available.

Correção

Enumeração de Fraquezas

CWE-623

Identificadores relacionados

CVE-2018-17925

Produtos afetados

Ge Ifix

Gigasoft Charting Package

Internet Explorer

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-17925 · Nota de Segurança
• https://ics-cert.us-cert.gov/advisories/ICSA-18-282-01 · Nota
• https://osv.dev/vulnerability/CVE-2018-17925 · Aviso do Fabricante
• http://securityfocus.com/bid/105540 · Nota