PT-2018-9732 · Digital Guardian · Digital Guardian Management Console

Published 2018-04-20 · Updated 2018-05-22 · CVE-2018-10174

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Digital Guardian Management Console version 7.1.2.0015

Description: The issue allows remote attackers to read arbitrary files via file:// URLs, send TCP traffic to intranet hosts, or obtain an NTLM hash. This can occur even if the logged-in user has a read-only role.

Recommendations: For Digital Guardian Management Console version 7.1.2.0015, consider restricting access to the management console to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the ability to read arbitrary files and send TCP traffic to intranet hosts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2018-10174

Affected Products

Digital Guardian Management Console

References · 3

• https://osv.dev/vulnerability/CVE-2018-10174 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-10174 · Security Note
• http://packetstormsecurity.com/files/147260/Digital-Guardian-Management-Console-7.1.2.0015-Server-Side-Request-Forgery.html · Note