PT-2008-6008 · Plain Black · Webgui

Published 2008-10-30 · Updated 2017-08-08 · CVE-2008-4798

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WebGUI versions prior to 7.5.30

Description The issue allows remote attackers to execute arbitrary code by uploading a Perl module and accessing it via a crafted URL, specifically through the loadModule function in lib/WebGUI/Asset.pm.

Recommendations For versions prior to 7.5.30, update to version 7.5.30 or later to resolve the issue. As a temporary workaround, consider restricting access to the loadModule function in lib/WebGUI/Asset.pm to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2008-4798

Affected Products

Webgui

References · 8

• http://secunia.com/advisories/32438 · Vendor Advisory
• http://securityfocus.com/bid/31947 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2008-4798 · Security Note
• http://webgui.org/uploads/70/o2/70o29CTLCGWjntJrLYdmJA/asset-security-7.4.diff · Note
• http://vupen.com/english/advisories/2008/2944 · Note
• http://webgui.org/getwebgui/advisories/webgui-7.5.30-stable-released · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46137 · Note
• http://webgui.org/bugs/tracker/8980 · Note