PT-2018-13406 · Vmware · Lxci

Published 2018-11-30 · Updated 2018-12-28 · CVE-2018-16093

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions LXCI for VMware versions prior to 5.5

Description The issue allows an authenticated user to write to any system file due to insufficient sanitization during the upload of a backup file.

Recommendations For versions prior to 5.5, update to version 5.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the backup file upload feature until a patch is available.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2018-16093

Affected Products

Lxci

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-16093 · Security Note
• https://osv.dev/vulnerability/CVE-2018-16093 · Vendor Advisory
• https://support.lenovo.com/us/en/solutions/LEN-23800 · Vendor Advisory