PT-2018-17627 · Plays.Tv · Plays.Tv

Publicado 2018-04-13 · Atualizado 2018-05-21 · CVE-2018-6547

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Crítica

Vetor base

AV:N/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions plays.tv service versions prior to 1.27.7.0

Description The issue concerns an HTTP message parsing function in the plays service.exe that writes non-user controlled data as SYSTEM to a file when the extract files parameter is used, without properly authenticating the user. This function takes a user-defined path.

Recommendations For versions prior to 1.27.7.0, update to version 1.27.7.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the extract files parameter until a patch is applied.

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2018-6547

Produtos afetados

Plays.Tv

Referências · 3

• https://securifera.com/advisories/CVE-2018-6547 · Nota
• https://osv.dev/vulnerability/CVE-2018-6547 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-6547 · Nota de Segurança