PT-2019-9301 · Swift · Swift Alliance Web Platform

Publicado 2019-07-05 · Atualizado 2020-08-24 · CVE-2018-16386

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SWIFT Alliance Web Platform version 7.1.23

Description An issue in the SWIFT Alliance Web Platform allows log injection and arbitrary log filename creation via the PATH INFO to "swp/login/EJBRemoteService/". This is related to error log information in com.swift.ejbgwt.j2ee.client.EjBlnvocationException, which contains null@java:comp/env/ error messages.

Recommendations For SWIFT Alliance Web Platform version 7.1.23, consider restricting access to the "swp/login/EJBRemoteService/" endpoint to minimize the risk of exploitation. As a temporary workaround, avoid using the PATH INFO to inject logs until a patch is available.

Correção

Improper Encoding or Escaping of Output

Enumeração de Fraquezas

CWE-116

Identificadores relacionados

CVE-2018-16386

Produtos afetados

Swift Alliance Web Platform

Referências · 4

• https://t.me/cvenotify/263 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2018-16386 · Nota de Segurança
• https://gist.github.com/shiham101/8763642e768582e0182f92cd41c482ec · Nota
• https://osv.dev/vulnerability/CVE-2018-16386 · Aviso do Fabricante