PT-2018-19078 · Kotti · Kotti

Ehaoxiongdiycwo · Published 2018-04-09 · Updated 2018-07-12 · CVE-2018-9856

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kotti versions prior to 1.3.2 Kotti versions 2.x prior to 2.0.0b2

Description The issue concerns a CSRF problem in the local roles implementation. It can be triggered by a permission change via the "/admin-document/@@share" API endpoint.

Recommendations For versions prior to 1.3.2, update to version 1.3.2 or later. For versions 2.x prior to 2.0.0b2, update to version 2.0.0b2 or later.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2018-9856

GHSA-3HQ4-F2V6-Q338

PYSEC-2018-10

Affected Products

Kotti

References · 9

• 🔥 https://github.com/Kotti/Kotti/issues/551 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-9856 · Security Note
• https://osv.dev/vulnerability/CVE-2018-9856 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3hq4-f2v6-q338 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2018-10 · Vendor Advisory
• https://github.com/Kotti/Kotti/commit/69d3c8a5d7203ddaec5ced5901acf87baddd76be · Note
• https://github.com/Kotti/Kotti · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/kotti/PYSEC-2018-10.yaml · Note
• https://github.com/advisories/GHSA-3hq4-f2v6-q338 · Note