PT-2018-15197 · Pydio · Pydio

Mike Gualtieri · Publicado 2018-07-23 · Atualizado 2018-09-20 · CVE-2018-1999018

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Pydio versions 8.2.1 and prior

Description The issue is related to unvalidated user input, leading to remote code execution. This can result in an attacker gaining admin access and executing arbitrary commands on the underlying OS. The attack is exploitable by editing the Antivirus Command in the antivirus plugin and executing the payload by uploading any file within Pydio.

Recommendations For Pydio versions 8.2.1 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-1999018

Produtos afetados

Pydio

Referências · 3

• 🔥 https://mike-gualtieri.com/files/Pydio-8-VulnerabilityDisclosure-Jul18.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-1999018 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-1999018 · Aviso do Fabricante