PT-2019-8801 · Heron-Ui · Heron-Ui

Published 2019-03-18 · Updated 2019-03-25 · CVE-2018-11789

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions heron-ui (affected versions not specified)

Description The issue allows individuals to access any file on the host by modifying the path parameter when accessing the heron-ui webpage. This can be achieved by altering the path parameter to navigate to the desired directory, for example, by using ..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd to view the /etc/passwd file.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-11789

Affected Products

Heron-Ui

References · 5

• 🔥 https://lists.apache.org/thread.html/5ea1a102d87a47c5912d745fa0d5dfa2830fc94099cbc30911f095b9@%3Cdev.heron.apache.org%3E · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-11789 · Security Note
• https://osv.dev/vulnerability/CVE-2018-11789 · Vendor Advisory
• http://securityfocus.com/bid/107430 · Note
• https://lists.apache.org/thread.html/5ea1a102d87a47c5912d745fa0d5dfa2830fc94099cbc30911f095b9%40%3Cdev.heron.apache.org%3E · Note