PT-2021-17070
CVE-2021-26597
·
تاريخ النشر
2021-03-25
·
تاريخ التحديث
2021-10-02
الوصف من
CVSS 3.1
6.5
متوسطةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions
Nokia NetAct version 18A
Description
A remote user, authenticated to the Nokia NetAct Web Page, can upload potentially dangerous files without restrictions. This is achieved by visiting the Site Configuration Tool web site section and using the
/netact/sct API endpoint with the dir parameter in conjunction with the operation=upload value.Recommendations
For Nokia NetAct version 18A, restrict access to the
/netact/sct API endpoint to prevent arbitrary file uploads until a fix is available. As a temporary workaround, consider disabling the file upload functionality via the operation=upload value to minimize the risk of exploitation.قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾