PT-2018-15537 · Sap · Crystal Reports Server

Publicado 2018-04-10 · Atualizado 2019-10-09 · CVE-2018-2406

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Crystal Reports Server, OEM Edition (CRSE) versions 4.0 through 4.30

Description The issue concerns an unquoted windows search path, also known as a directory/path traversal vulnerability, in the startup path of the affected software.

Recommendations For Crystal Reports Server, OEM Edition (CRSE) versions 4.0 through 4.30, update the startup path to properly quote the directory to prevent path traversal attacks.

Correção

Enumeração de Fraquezas

CWE-428

Identificadores relacionados

CVE-2018-2406

Produtos afetados

Crystal Reports Server

Referências · 5

• http://securityfocus.com/bid/103719 · Nota
• https://osv.dev/vulnerability/CVE-2018-2406 · Aviso do Fabricante
• https://launchpad.support.sap.com/#/notes/2560132 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-2406 · Nota de Segurança
• https://blogs.sap.com/2018/04/10/sap-security-patch-day-april-2018 · Aviso do Fabricante