PT-2018-12768 · Ocs Inventory · Ocsinventory-Server

Simon Uvarov · Published 2018-08-06 · Updated 2018-10-10 · CVE-2018-14857

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OCS Inventory Server versions prior to 2.5

Description The issue allows a privileged user to gain access to the server via a template file containing PHP code. This is due to unrestricted file upload in the require/mail/NotificationMail.php file in Webconsole, where file extensions other than .html are permitted.

Recommendations For versions prior to 2.5, restrict file uploads to only allow .html extensions to prevent remote code execution. As a temporary workaround, consider disabling the file upload feature in the Webconsole until a patch is available.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2018-14857

Affected Products

Ocsinventory-Server

References · 8

• https://security-tracker.debian.org/tracker/CVE-2018-14857 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-14857 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-14857 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14857 · Vendor Advisory
• https://github.com/OCSInventory-NG/OCSInventory-ocsreports/commit/cc572819e373f7ff81dec61591b6f465b43c5515 · Note
• http://seclists.org/fulldisclosure/2018/Aug/6 · Note
• http://securitytracker.com/id/1041418 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14857 · Note