PT-2018-18205 · Micro Focus+1 · Micro Focus Solutions Business Manager+1

Publicado 2018-06-21 · Atualizado 2021-04-09 · CVE-2018-7679

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Micro Focus Solutions Business Manager versions prior to 11.4

Description The issue arises when ASP.NET is configured with execute permission on the virtual directories and does not validate the contents of user avatar images, which could lead to remote code execution.

Recommendations For versions prior to 11.4, ensure that ASP.NET is configured to validate the contents of user avatar images and remove execute permission on the virtual directories to prevent remote code execution.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2018-7679

Produtos afetados

Asp.Net

Micro Focus Solutions Business Manager

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-7679 · Nota de Segurança
• http://help.serena.com/doc_center/sbm/ver11_4/sbm_release_notes.htm · Nota
• https://osv.dev/vulnerability/CVE-2018-7679 · Aviso do Fabricante