PT-2018-14679 · Mcms · Mcms

Devote · Published 2018-10-30 · Updated 2018-12-11 · CVE-2018-18830

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MCMS version 4.6.5

Description An issue was discovered in the FileAction.java file, where the upload interface does not verify the user login status, allowing files to be uploaded without setting a cookie. This can be exploited by uploading JSP code with a .png filename, intercepting the data packet, and changing the suffix to jsp in the name parameter. The server then returns the storage path of the file, which can be accessed to execute arbitrary JSP code.

Recommendations For MCMS version 4.6.5, as a temporary workaround, consider restricting access to the upload interface until a patch is available. Additionally, restrict access to the FileAction.java file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2018-18830

GHSA-C7C7-XM8G-XM36

Affected Products

Mcms

References · 6

• https://osv.dev/vulnerability/GHSA-c7c7-xm8g-xm36 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-18830 · Security Note
• https://osv.dev/vulnerability/CVE-2018-18830 · Vendor Advisory
• https://github.com/advisories/GHSA-c7c7-xm8g-xm36 · Note
• https://gitee.com/mingSoft/MCMS/issues/IO0IQ · Note
• https://gitee.com/mingSoft/MCMS · Note