PT-2018-9431 · Lms · Lms

Publicado 2018-06-26 · Atualizado 2019-09-18 · CVE-2018-1000535

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions LMS versions <= LMS 011123

Description The issue is related to a Local File Disclosure vulnerability in the File reading functionality of the LMS module. This can result in the possibility of reading files on the server. The attack appears to be exploitable via the GET parameter.

Recommendations For LMS versions <= LMS 011123, update to a version that includes the fix committed after 254765e to resolve the issue. As a temporary workaround, consider restricting access to the File reading functionality in the LMS module to minimize the risk of exploitation. Avoid using the GET parameter in the affected LMS module until the issue is resolved.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2018-1000535

Produtos afetados

Lms

Referências · 4

• 🔥 https://github.com/lmsgit/lms/issues/1271 · Exploit
• 🔥 https://0dd.zone/2018/06/01/LMS-Local-File-Disclosure · Exploit
• https://osv.dev/vulnerability/CVE-2018-1000535 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000535 · Nota de Segurança