PT-2018-9407 · Unknown · Redirection

Glyn Wintle · Published 2018-06-26 · Updated 2019-10-03 · CVE-2018-1000509

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Redirection version 2.7.1

Description The issue is related to a Serialisation vulnerability in the Settings page AJAX, which could allow an admin to execute arbitrary code under certain circumstances. This attack is exploitable if the attacker has access to an admin account.

Recommendations For version 2.7.1, update to version 2.8 to resolve the issue.

Exploit

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2018-1000509

Affected Products

Redirection

References · 4

• 🔥 https://advisories.dxw.com/advisories/unserialization-redirection · Exploit
• https://osv.dev/vulnerability/CVE-2018-1000509 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000509 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000509 · Note