PT-2018-14511 · Serverscheck · Serverscheck Monitoring

Hyp3Rlinx + 1 · Publicado 2018-10-24 · Atualizado 2018-12-06 · CVE-2018-18552

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ServersCheck Monitoring Software versions prior to 14.3.4

Description The issue allows local users to cause a denial of service, resulting in menu functionality loss. This is achieved by creating an LNK file that points to a second LNK file associated with a Start menu. The root cause is a Directory Traversal bug via the id parameter in the sensor details.html file, enabling the creation of empty files in arbitrary directories.

Recommendations For versions prior to 14.3.4, update to version 14.3.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the sensor details.html file to minimize the risk of exploitation. Avoid using the id parameter in the sensor details.html file until the issue is resolved.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-18552

Produtos afetados

Serverscheck Monitoring

Referências · 4

• 🔥 http://packetstormsecurity.com/files/149907/ServersCheck-Monitoring-Software-14.3.3-Arbitrary-File-Write-DoS.html · Exploit
• 🔥 http://hyp3rlinx.altervista.org/advisories/CVE-2018-18552-SERVERSCHECK-MONITORING-SOFTWARE-ARBITRARY-FILE-WRITE-DOS.txt · Exploit
• https://osv.dev/vulnerability/CVE-2018-18552 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-18552 · Nota de Segurança