PT-2018-2245 · Unknown · S3 Browser

Igor Kanygin · Publicado 2018-10-09 · Atualizado 2019-02-04 · CVE-2018-20298

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions S3 Browser versions prior to 8.1.5

Description The issue is related to an XML external entity (XXE) vulnerability in the S3 protocol, which is based on HTTP. This vulnerability allows remote attackers to read arbitrary files and obtain NTLMv2 hash values by tricking a user into connecting to a malicious server. The exploitation of this vulnerability can enable a remote attacker to view files and obtain user NTLMv2 hash values by masquerading as a legitimate server.

Recommendations For versions prior to 8.1.5, update to version 8.1.5 or later to resolve the issue.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

BDU:2019-00308

CVE-2018-20298

Produtos afetados

S3 Browser

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-20298 · Nota de Segurança
• https://ptsecurity.com/ww-en/analytics/threatscape/pt-2018-34 · Nota
• https://osv.dev/vulnerability/CVE-2018-20298 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-00308 · Nota de Segurança
• https://s3browser.com/news.aspx · Aviso do Fabricante
• https://ptsecurity.com/ru-ru/research/threatscape/pt-2018-34 · Nota