PT-2019-12749 · Deltek · Deltek Maconomy

Ras313 · Publicado 2019-05-24 · Atualizado 2019-11-05 · CVE-2019-12314

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Deltek Maconomy version 2.2.5

Description The issue allows for local file inclusion via absolute path traversal. This can be achieved through the "WS.macx1.W MCS/" endpoint in the PATH INFO, as demonstrated by accessing a "cgi-bin/Maconomy/MaconomyWS.macx1.W MCS/etc/passwd" URI.

Recommendations For Deltek Maconomy version 2.2.5, consider restricting access to the "WS.macx1.W MCS/" endpoint to minimize the risk of exploitation. Avoid using absolute paths in the PATH INFO to prevent traversal attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2019-12314

GHSA-8762-RF4G-23XM

Produtos afetados

Deltek Maconomy

Referências · 6

• 🔥 https://github.com/JameelNabbo/exploits/blob/master/Maconomy%20Erp%20local%20file%20include.txt · Exploit
• 🔥 http://packetstormsecurity.com/files/153079/Deltek-Maconomy-2.2.5-Local-File-Inclusion.html · Exploit
• 🔥 https://exploit-db.com/exploits/46931 · Exploit
• 🔥 https://github.com/ras313/CVE-2019-12314/security/advisories/GHSA-8762-rf4g-23xm · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-12314 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-12314 · Aviso do Fabricante