PT-2018-16798 · Ml Report · Ml Report

Publicado 2018-12-28 · Atualizado 2019-02-11 · CVE-2018-5204

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ML Report versions 2.00.000.0000 through 2.18.628.5980

Description The issue allows a remote attacker to download and execute a remote arbitrary file by setting the arguments to the activex method, which can be leveraged for code execution.

Recommendations For ML Report versions 2.00.000.0000 through 2.18.628.5980, consider disabling the activex method until a patch is available to prevent remote code execution.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2018-5204

Produtos afetados

Ml Report

Referências · 3

• https://osv.dev/vulnerability/CVE-2018-5204 · Aviso do Fabricante
• https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=30123 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-5204 · Nota de Segurança