PT-2018-13790 · Unknown+1 · Masscan.Py+1

Gsfish · Published 2018-09-12 · Updated 2018-11-02 · CVE-2018-16951

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions xunfeng version 0.2.0

Description The issue allows command execution via CSRF due to masscan.py mishandling backquote characters.

Recommendations For xunfeng version 0.2.0, consider restricting access to the masscan.py script to minimize the risk of exploitation until a patch is available.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2018-16951

Affected Products

Masscan.Py

Xunfeng

References · 3

• 🔥 https://github.com/ysrc/xunfeng/issues/176 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-16951 · Security Note
• https://osv.dev/vulnerability/CVE-2018-16951 · Vendor Advisory