PT-2018-18287 · Struxureware · Data Center Expert

Publicado 2018-11-30 · Atualizado 2018-12-28 · CVE-2018-7807

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Data Center Expert versions 7.5.0 and earlier

Description: The issue allows for the upload of a malicious zip file from the user interface to the server, potentially containing path traversal file names. This could enable the arbitrary upload of files onto the server file system outside of the intended directory, leveraging the ZipSlip vulnerability within Java code.

Recommendations: For Data Center Expert versions 7.5.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2018-7807

Produtos afetados

Data Center Expert

Referências · 3

• https://osv.dev/vulnerability/CVE-2018-7807 · Aviso do Fabricante
• https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-7807 · Nota de Segurança