PT-2018-13622 · Kaizen · Kaizen Asset Manager+1

Published 2018-09-05 · Updated 2019-10-03 · CVE-2018-16545

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kaizen Asset Manager (Enterprise Edition) (affected versions not specified) Kaizen Training Manager (Enterprise Edition) (affected versions not specified)

Description The issue allows a remote attacker to achieve arbitrary code execution via file impersonation. This can be done by assuming the identity of a temporary file, for example, by making a malicious dynamic-link library (dll) impersonate a temporary (tmp) file, such as isxdl.dll, or by making an executable file impersonate a temporary file, such as 996E.temp.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2018-16545

Affected Products

Kaizen Asset Manager

Kaizen Training Manager

References · 3

• 🔥 https://github.com/GitHubAssessments/CVE_Assessment_03_2018/blob/master/Kaizen_Report.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-16545 · Security Note
• https://osv.dev/vulnerability/CVE-2018-16545 · Vendor Advisory