PT-2019-9589 · Tufin · Tufinos+1

Publicado 2019-06-19 · Atualizado 2019-06-24 · CVE-2018-18406

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Tufin SecureTrack version 18.1 with TufinOS 2.16 build 1179(Final)

Description A blind XXE vulnerability was discovered in the Audit Report module. This issue occurs when a new Best Practices Report is saved using a special payload inside the xml input field. The vulnerability is considered blind because the response does not directly display the requested file, but instead returns it inside the name data field when the report is saved. As a result, an attacker can view restricted operating system files. This issue affects all types of users, including administrators and normal users.

Recommendations For Tufin SecureTrack version 18.1 with TufinOS 2.16 build 1179(Final), consider disabling the Audit Report module or restricting access to it until a patch is available. Avoid using the xml input field in the affected module to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2018-18406

Produtos afetados

Tufin Securetrack

Tufinos

Referências · 5

• 🔥 https://exploit-db.com/exploits/45808 · Exploit
• https://osv.dev/vulnerability/CVE-2018-18406 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-18406 · Nota de Segurança
• https://forum.tufin.com/support/kc/latest · Aviso do Fabricante
• https://tufin.com · Aviso do Fabricante