PT-2018-13073 · Ocs Inventory+1 · Ocs Inventory Ng+1

Simon Uvarov · Published 2018-11-29 · Updated 2019-01-31 · CVE-2018-15537

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OCS Inventory NG (affected versions not specified)

Description The issue allows a privileged user to gain access to the server via crafted HTTP requests, exploiting an unrestricted file upload vulnerability with remote code execution in the ocsreports component.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2018-15537

Affected Products

Debian

Ocs Inventory Ng

References · 9

• https://security-tracker.debian.org/tracker/CVE-2018-15537 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15537 · Security Note
• https://ubuntu.com/security/CVE-2018-15537 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-15537 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-15537 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-15537 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-15537 · Vendor Advisory
• http://packetstormsecurity.com/files/150330/OCS-Inventory-NG-ocsreports-Shell-Upload.html · Note
• http://seclists.org/fulldisclosure/2018/Nov/40 · Note