PT-2018-16798 · Ml Report · Ml Report

Published 2018-12-28 · Updated 2019-02-11 · CVE-2018-5204

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ML Report versions 2.00.000.0000 through 2.18.628.5980

Description The issue allows a remote attacker to download and execute a remote arbitrary file by setting the arguments to the activex method, which can be leveraged for code execution.

Recommendations For ML Report versions 2.00.000.0000 through 2.18.628.5980, consider disabling the activex method until a patch is available to prevent remote code execution.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2018-5204

Affected Products

Ml Report

References · 3

• https://osv.dev/vulnerability/CVE-2018-5204 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-5204 · Security Note
• https://boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=30123 · Note