PT-2018-14399 · Lemon · Lemon

Publicado 2018-10-15 · Atualizado 2019-01-11 · CVE-2018-18315

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions lemon version 1.9.0

Description The issue allows attackers to upload arbitrary files due to insufficient validation in the copyMultipartFileToFile method within CdnUtils. Specifically, it only checks for a ../ substring and does not validate the file type and spaceName parameter.

Recommendations For lemon version 1.9.0, consider validating the file type and spaceName parameter in the copyMultipartFileToFile method to prevent arbitrary file uploads. As a temporary workaround, restrict access to the CdnController to minimize the risk of exploitation.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2018-18315

Produtos afetados

Lemon

Referências · 3

• https://github.com/xuhuisheng/lemon/issues/175 · Nota
• https://osv.dev/vulnerability/CVE-2018-18315 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-18315 · Nota de Segurança