PT-2018-9407 · Unknown · Redirection

Glyn Wintle · Publicado 2018-06-26 · Atualizado 2019-10-03 · CVE-2018-1000509

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Redirection version 2.7.1

Description The issue is related to a Serialisation vulnerability in the Settings page AJAX, which could allow an admin to execute arbitrary code under certain circumstances. This attack is exploitable if the attacker has access to an admin account.

Recommendations For version 2.7.1, update to version 2.8 to resolve the issue.

Exploit

Correção

Deserialization of Untrusted Data

Enumeração de Fraquezas

CWE-502

Identificadores relacionados

CVE-2018-1000509

Produtos afetados

Redirection

Referências · 4

• 🔥 https://advisories.dxw.com/advisories/unserialization-redirection · Exploit
• https://osv.dev/vulnerability/CVE-2018-1000509 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000509 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000509 · Nota