PT-2018-11104 · Asustor · Asustor Adm

Published 2018-12-04 · Updated 2018-12-27 · CVE-2018-12306

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ASUSTOR ADM version 3.1.1

Description A directory traversal issue in the File Explorer component allows attackers to view arbitrary files by modifying the file1 URL parameter. This issue is similar to a previously known problem.

Recommendations For ASUSTOR ADM version 3.1.1, avoid using the file1 parameter in the affected URL until the issue is resolved. Consider restricting access to the File Explorer component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-12306

Affected Products

Asustor Adm

References · 3

• 🔥 https://blog.securityevaluators.com/over-a-dozen-vulnerabilities-discovered-in-asustor-as-602t-8dd5832a82cc · Exploit
• https://osv.dev/vulnerability/CVE-2018-12306 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12306 · Security Note