PT-2023-10114 · Unknown · Soshtolsus Wing-Tight

Published 2023-01-05 · Updated 2024-05-17 · CVE-2014-125044

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions soshtolsus wing-tight versions prior to 1.0.0

Description A critical vulnerability was found in soshtolsus wing-tight, affecting an unknown part of the file index.php. The manipulation of the p argument leads to file inclusion, and it is possible to initiate the attack remotely.

Recommendations For versions prior to 1.0.0, upgrade to version 1.0.0 to address this issue. As a temporary workaround, consider restricting access to the p argument in the affected file index.php until the upgrade is applied.

Fix

Weakness Enumeration

CWE-610

CWE-73

Related Identifiers

CVE-2014-125044

Affected Products

Soshtolsus Wing-Tight

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2014-125044 · Security Note
• https://github.com/soshtolsus/wing-tight/commit/567bc33e6ed82b0d0179c9add707ac2b257aeaf2 · Patch
• https://github.com/soshtolsus/wing-tight/releases/tag/1.0.0 · Patch
• https://t.me/cvenotify/41361 · Telegram Post
• https://vuldb.com/?id.217515 · Note
• https://vuldb.com/?ctiid.217515 · Note
• https://t.me/cibsecurity/56001 · Telegram Post