PT-2018-14285 · Nuuo · Nuuo Cms

Pedro Ribeiro · Published 2018-11-27 · Updated 2019-10-09 · CVE-2018-17936

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NUUO CMS versions 3.3 and prior

Description The issue allows the upload of arbitrary files that can modify or overwrite configuration files to the server, potentially enabling remote code execution.

Recommendations For versions 3.3 and prior, update to a version later than 3.3 to resolve the issue.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2018-17936

Affected Products

Nuuo Cms

References · 4

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/nuuo/nuuo_cms_fu.rb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-17936 · Security Note
• https://osv.dev/vulnerability/CVE-2018-17936 · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-18-284-02 · Note