PT-2018-11466 · Webgrind · Webgrind

Abhikafle123 · Published 2018-06-27 · Updated 2024-08-05 · CVE-2018-12909

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Webgrind version 1.5

Description The issue allows anyone to view files from the local filesystem that the webserver user has access to. This is achieved by manipulating the file parameter in the /index.php API endpoint, specifically through the op=fileviewer&file= URI. It is noted that the vendor does not intend the product for use in a publicly accessible environment.

Recommendations For Webgrind version 1.5, as a temporary workaround, consider restricting access to the fileviewer operation in the index.php endpoint to minimize the risk of exploitation. Avoid using the file parameter in the affected API endpoint until the issue is resolved.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALT-PU-2023-8422

CVE-2018-12909

Affected Products

Webgrind

References · 7

• https://errata.altlinux.org/ALT-PU-2023-8422 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12909 · Security Note
• https://osv.dev/vulnerability/CVE-2018-12909 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-12909 · Security Note
• https://github.com/jokkedk/webgrind/issues/112 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12909 · Note
• https://packages.altlinux.org/ru/vuln/CVE-2018-12909 · Note