PT-2018-1533 · Ca · Ca Release Automation

Jakub Palaczynski + 1 · Published 2018-08-29 · Updated 2021-04-12 · CVE-2018-15691

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CA Release Automation versions 6.5 and earlier

Description The issue is caused by insecure deserialization of a specially crafted serialized object, which allows attackers to potentially execute arbitrary code. This can be exploited by a remote attacker using a specially formed serialized object, potentially leading to the execution of arbitrary code.

Recommendations For CA Release Automation versions 6.5 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2018-01088

CVE-2018-15691

Affected Products

Ca Release Automation

References · 10

• 🔥 https://exploit-db.com/exploits/45425 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-15691 · Security Note
• https://bdu.fstec.ru/vul/2018-01088 · Security Note
• https://support.ca.com/us/product-content/recommended-reading/security-notices/ca20180829-03--security-notice-for-ca-release-automation.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-15691 · Vendor Advisory
• https://securitylab.ru/vulnerability/495397.php · Note
• http://securitytracker.com/id/1041591 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-15691 · Note
• http://securityfocus.com/bid/105197 · Note
• https://cybersecurity-help.cz/vdb/SB2018090201 · Note