PT-2018-8566 · Juniper Networks · Appformix

Publicado 2018-02-22 · Atualizado 2019-10-03 · CVE-2018-0015

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: AppFormix versions prior to 2.7.3 AppFormix versions 2.11 prior to 2.11.3 AppFormix versions 2.15 prior to 2.15.2

Description: A malicious user with unrestricted access to the AppFormix application management platform may be able to access a Python debug console and execute system commands with root privilege. The AppFormix Agent exposes the debug console on a host where AppFormix Agent is executing, allowing an attacker to access the debug console and execute Python commands with root privilege. This issue has been seen in a production network, but there is no known case of malicious exploitation.

Recommendations: For AppFormix versions prior to 2.7.3, update to version 2.7.3 or later. For AppFormix versions 2.11 prior to 2.11.3, update to version 2.11.3 or later. For AppFormix versions 2.15 prior to 2.15.2, update to version 2.15.2 or later.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2018-0015

Produtos afetados

Appformix

Referências · 3

• https://kb.juniper.net/JSA10843 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-0015 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-0015 · Nota de Segurança