PT-2018-14282 · Apache Friends+1 · Xampp Client+1

Dan Regalado · Publicado 2018-10-30 · Atualizado 2019-10-09 · CVE-2018-17933

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VGo Robot versions 3.0.3.52164 through 3.0.3.53662 VGo Robot versions prior to 3.0.3.52164

Description The issue allows user accounts to execute commands outside their privileges, potentially within the scope of an admin account. If an attacker has access to VGo XAMPP Client credentials, they may be able to execute admin commands on the connected robot.

Recommendations For VGo Robot versions 3.0.3.52164 through 3.0.3.53662, update to a version that includes a fix for this issue. For VGo Robot versions prior to 3.0.3.52164, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to admin commands on the connected robot until a patch is available. Restrict access to VGo XAMPP Client credentials to minimize the risk of exploitation.

Correção

Improper Authorization

Enumeração de Fraquezas

CWE-285

Identificadores relacionados

CVE-2018-17933

Produtos afetados

Vgo Robot

Xampp Client

Referências · 3

• https://osv.dev/vulnerability/CVE-2018-17933 · Aviso do Fabricante
• https://ics-cert.us-cert.gov/advisories/ICSA-18-114-01 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-17933 · Nota de Segurança