PT-2018-15253 · Ptc · Ptc Thingworx Platform

Publicado 2018-12-17 · Atualizado 2019-07-02 · CVE-2018-20092

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions PTC ThingWorx Platform versions prior to 8.3.1

Description The issue allows for a directory traversal attack on ZIP files via a POST request. This can potentially lead to unauthorized access to sensitive files and directories.

Recommendations For PTC ThingWorx Platform versions prior to 8.3.1, update to version 8.3.1 or later to resolve the issue. As a temporary workaround, consider restricting access to ZIP file handling functionality until a patch is available.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-20092

Produtos afetados

Ptc Thingworx Platform

Referências · 6

• https://osv.dev/vulnerability/CVE-2018-20092 · Aviso do Fabricante
• https://t.me/defcon_news/17985 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2018-20092 · Nota de Segurança
• https://t.me/rnetsec/9854 · Publicação no Telegram
• https://doyler.net/security-not-included/ptc-thingworx-vulnerability · Nota
• https://ptc.com/en/documents/security/coordinated-vulnerability-disclosure/security-vulnerabilities · Aviso do Fabricante