PT-2023-10832 · Unknown+1 · Online Accounting System+1

Pich4Ya · Publicado 2023-12-03 · Atualizado 2024-05-17 · CVE-2018-25094

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ระบบบัญชีออนไลน์ Online Accounting System versions up to 1.4.0

Description A problematic issue affects the processing of the file ckeditor/filemanager/browser/default/image.php. The manipulation of the argument fid with the input ../../../etc/passwd leads to path traversal. The exploit has been disclosed to the public and may be used.

Recommendations For versions up to 1.4.0, upgrade to version 2.0.0 to address this issue. As a temporary workaround, consider restricting access to the vulnerable file ckeditor/filemanager/browser/default/image.php until the upgrade is applied. Avoid using the argument fid with potentially malicious input in the affected file.

Correção

Path traversal

Enumeração de Fraquezas

CWE-24

CWE-22

Identificadores relacionados

CVE-2018-25094

Produtos afetados

Ckeditor

Online Accounting System

Referências · 7

• https://t.me/cvenotify/62004 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2018-25094 · Aviso do Fabricante
• https://vuldb.com/?id.246641 · Nota
• https://t.me/cvenotify/62646 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2018-25094 · Nota de Segurança
• https://vuldb.com/?ctiid.246641 · Nota
• https://github.com/59160781/project/commit/9d9618422b980335bb30be612ea90f4f56cb992c · Correção