PT-2018-17627 · Plays.Tv · Plays.Tv

Published 2018-04-13 · Updated 2018-05-21 · CVE-2018-6547

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Critical

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions plays.tv service versions prior to 1.27.7.0

Description The issue concerns an HTTP message parsing function in the plays service.exe that writes non-user controlled data as SYSTEM to a file when the extract files parameter is used, without properly authenticating the user. This function takes a user-defined path.

Recommendations For versions prior to 1.27.7.0, update to version 1.27.7.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the extract files parameter until a patch is applied.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2018-6547

Affected Products

Plays.Tv

References · 3

• https://osv.dev/vulnerability/CVE-2018-6547 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-6547 · Security Note
• https://securifera.com/advisories/CVE-2018-6547 · Note