PT-2018-14511 · Serverscheck · Serverscheck Monitoring

Hyp3Rlinx + 1 · Published 2018-10-24 · Updated 2018-12-06 · CVE-2018-18552

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ServersCheck Monitoring Software versions prior to 14.3.4

Description The issue allows local users to cause a denial of service, resulting in menu functionality loss. This is achieved by creating an LNK file that points to a second LNK file associated with a Start menu. The root cause is a Directory Traversal bug via the id parameter in the sensor details.html file, enabling the creation of empty files in arbitrary directories.

Recommendations For versions prior to 14.3.4, update to version 14.3.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the sensor details.html file to minimize the risk of exploitation. Avoid using the id parameter in the sensor details.html file until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-18552

Affected Products

Serverscheck Monitoring

References · 4

• 🔥 http://packetstormsecurity.com/files/149907/ServersCheck-Monitoring-Software-14.3.3-Arbitrary-File-Write-DoS.html · Exploit
• 🔥 http://hyp3rlinx.altervista.org/advisories/CVE-2018-18552-SERVERSCHECK-MONITORING-SOFTWARE-ARBITRARY-FILE-WRITE-DOS.txt · Exploit
• https://osv.dev/vulnerability/CVE-2018-18552 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-18552 · Security Note