PT-2018-9518 · Gig Technology Nv · Jumpscale Portal

Vrico315 · Publicado 2018-09-06 · Atualizado 2019-03-07 · CVE-2018-1000666

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GIG Technology NV JumpScale Portal 7 versions before commit 15443122ed2b1cbfd7bdefc048bf106f075becdb

Description The issue is related to an OS Command Injection vulnerability in the notifySpaceModification method. This vulnerability can result in improper validation of parameters, leading to command execution. The attack appears to be exploitable via network connectivity and requires minimal authentication privileges, as everyone can register an account.

Recommendations For GIG Technology NV JumpScale Portal 7 versions before commit 15443122ed2b1cbfd7bdefc048bf106f075becdb, update to a version after commit 15443122ed2b1cbfd7bdefc048bf106f075becdb to resolve the issue. As a temporary workaround, consider restricting access to the notifySpaceModification method until a patch is available.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2018-1000666

Produtos afetados

Jumpscale Portal

Referências · 8

• 🔥 https://github.com/0-complexity/openvcloud/issues/1207 · Exploit
• 🔥❌ https://github.com/jumpscale7/jumpscale_portal/blob/c997bb1824862b08246d60e34e950df06ebac68c/apps/portalbase/system/system__contentmanager/methodclass/system_contentmanager.py#L293-L315 · Exploit, Deleted
• 🔥 https://telegra.ph/Description-of-vulnerability-in-JumpScale-Portal-7-08-23 · Exploit
• 🔥 https://medium.com/@vrico315/vulnerability-in-jumpscale-portal-7-a88098a1caca · Exploit
• https://osv.dev/vulnerability/CVE-2018-1000666 · Aviso do Fabricante
• ❌ https://github.com/jumpscale7/jumpscale_portal/pull/108 · Nota, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000666 · Nota de Segurança
• https://medium.com/%40vrico315/vulnerability-in-jumpscale-portal-7-a88098a1caca · Nota