PT-2018-11775 · Terramaster · Terramaster Tos

Published 2018-11-27 · Updated 2019-10-03 · CVE-2018-13355

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions TerraMaster TOS version 3.1.03

Description The issue is related to incorrect access controls in the ajaxdata.php file, which allows attackers to create user groups without proper authorization.

Recommendations For TerraMaster TOS version 3.1.03, update the access controls in the ajaxdata.php file to require proper authorization for creating user groups.

Exploit

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2018-13355

Affected Products

Terramaster Tos

References · 3

• 🔥 https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-13355 · Security Note
• https://osv.dev/vulnerability/CVE-2018-13355 · Vendor Advisory