PT-2018-13422 · Opsview · Opsview Monitor

Published 2018-09-05 · Updated 2019-10-03 · CVE-2018-16144

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Opsview Monitor versions prior to 5.3.1 Opsview Monitor versions 5.4.x prior to 5.4.2

Description The issue arises from improper sanitization of the rancid password parameter in the test connection functionality of the NetAudit section, leading to command injection.

Recommendations For versions prior to 5.3.1, update to version 5.3.1 or later. For versions 5.4.x prior to 5.4.2, update to version 5.4.2 or later.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2018-16144

Affected Products

Opsview Monitor

References · 6

• 🔥 https://seclists.org/fulldisclosure/2018/Sep/3 · Exploit
• 🔥 https://coresecurity.com/advisories/opsview-monitor-multiple-vulnerabilities · Exploit
• https://knowledge.opsview.com/v5.3/docs/whats-new · Vendor Advisory
• https://knowledge.opsview.com/v5.4/docs/whats-new · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-16144 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-16144 · Security Note