PT-2018-11494 · Seeddms · Seeddms

Published 2018-07-31 · Updated 2018-09-28 · CVE-2018-12939

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SeedDMS versions prior to 5.1.8

Description A directory traversal flaw allows an authenticated attacker to write to or potentially delete arbitrary files by using a .. (dot dot) in the "qquuid" parameter of the "op/op.UploadChunks.php" endpoint. This can be leveraged to execute arbitrary code.

Recommendations For versions prior to 5.1.8, update to version 5.1.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the "op/op.UploadChunks.php" endpoint or disabling the qquuid parameter to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-12939

Affected Products

Seeddms

References · 4

• https://osv.dev/vulnerability/CVE-2018-12939 · Vendor Advisory
• https://sourceforge.net/p/seeddms/code/ci/seeddms-5.1.x/tree/CHANGELOG · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-12939 · Security Note
• https://contextis.com/resources/advisories/cve-2018-12939 · Patch