PT-2018-16933 · Comsenz · Discuzx

Published 2018-01-12 · Updated 2019-10-03 · CVE-2018-5377

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DiscuzX version X3.4

Description The issue allows remote attackers to bypass intended access restrictions. This is achieved via the action parameter in the "archiver/index.php" endpoint.

Recommendations For DiscuzX version X3.4, consider restricting access to the "archiver/index.php" endpoint until a patch is available. As a temporary workaround, avoid using the action parameter in this endpoint to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2018-5377

Affected Products

Discuzx

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-5377 · Security Note
• https://osv.dev/vulnerability/CVE-2018-5377 · Vendor Advisory
• http://whsgwl.net/text.php?textid=36 · Note