PT-2018-18287 · Struxureware · Data Center Expert

Published 2018-11-30 · Updated 2018-12-28 · CVE-2018-7807

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Data Center Expert versions 7.5.0 and earlier

Description: The issue allows for the upload of a malicious zip file from the user interface to the server, potentially containing path traversal file names. This could enable the arbitrary upload of files onto the server file system outside of the intended directory, leveraging the ZipSlip vulnerability within Java code.

Recommendations: For Data Center Expert versions 7.5.0 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-7807

Affected Products

Data Center Expert

References · 3

• https://osv.dev/vulnerability/CVE-2018-7807 · Vendor Advisory
• https://help.ecostruxureit.com/display/public/UADCE725/Security+fixes+in+StruxureWare+Data+Center+Expert+v7.6.0 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-7807 · Security Note