PT-2018-18286 · Schneider Electric · Data Center Operation

Publicado 2018-11-30 · Atualizado 2018-12-28 · CVE-2018-7806

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Data Center Operation (affected versions not specified)

Description: The issue allows for the arbitrary upload of files onto the server file system outside of the intended directory by exploiting the ZipSlip vulnerability within Java code. This can occur when a carefully crafted, malicious zip file is uploaded by an authenticated user, potentially containing path traversal file names.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-7806

Produtos afetados

Data Center Operation

Referências · 2

• https://help.ecostruxureit.com/display/public/UADCO8x/StruxureWare+Data+Center+Operation+Software+Vulnerability+Fixes · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-7806 · Nota de Segurança