PT-2019-8883 · Seagate · Seagate Nas Os

Publicado 2019-05-13 · Atualizado 2019-10-03 · CVE-2018-12296

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Seagate NAS OS version 4.3.15.1

Description The issue is related to insufficient access control in the "/api/external/7.0/system.System.get infos" API endpoint, which allows attackers to obtain information about the NAS without authentication by sending empty POST requests.

Recommendations For Seagate NAS OS version 4.3.15.1, consider restricting access to the "/api/external/7.0/system.System.get infos" API endpoint to prevent unauthorized information disclosure until a patch is available.

Exploit

Correção

Incorrect Permission

Enumeração de Fraquezas

CWE-732

Identificadores relacionados

CVE-2018-12296

Produtos afetados

Seagate Nas Os

Referências · 3

• 🔥 https://blog.securityevaluators.com/invading-your-personal-cloud-ise-labs-exploits-the-seagate-stcr3000101-ecf89de2170 · Exploit
• https://osv.dev/vulnerability/CVE-2018-12296 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-12296 · Nota de Segurança