PT-2019-12953 · Hunesion · Hunesion I-Onenet

Publicado 2019-07-10 · Atualizado 2023-02-28 · CVE-2019-12803

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Hunesion i-oneNet versions 3.0.7 through 3.0.53 Hunesion i-oneNet versions 4.0.4 through 4.0.16

Description The issue arises from the specific upload web module not verifying the file extension and type, allowing an attacker to upload a webshell. After uploading the webshell, an attacker can use it to perform remote code execution, such as running system commands.

Recommendations For Hunesion i-oneNet versions 3.0.7 through 3.0.53, consider disabling the upload web module until a patch is available. For Hunesion i-oneNet versions 4.0.4 through 4.0.16, consider disabling the upload web module until a patch is available. As a temporary workaround, restrict access to the upload web module to minimize the risk of exploitation.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-12803

Produtos afetados

Hunesion I-Onenet

Referências · 3

• https://osv.dev/vulnerability/CVE-2019-12803 · Aviso do Fabricante
• https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=35073 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-12803 · Nota de Segurança