PT-2018-11107

CVE-2018-12309

·

Publicado

2018-12-04

·

Atualizado

2018-12-27

Descrição por

CVSS 3.1
7.5
Alta
MétricasAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions ASUSTOR ADM version 3.1.1
Description The issue allows attackers to upload files to arbitrary locations by modifying the path URL parameter in the upload.cgi. This can potentially lead to unauthorized access and modification of sensitive files.
Recommendations For ASUSTOR ADM version 3.1.1, consider restricting access to the upload.cgi until a patch is available. As a temporary workaround, avoid using the path URL parameter in the upload.cgi to minimize the risk of exploitation.
Explorabilidade
Exploit
Correção
Impactos
Fornecedores
Produtos afetados
Enumeração de fraquezas
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')
Identificadores relacionados
CVE-2018-12309
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com