PT-2018-11107

CVE-2018-12309

·

Published

2018-12-04

·

Updated

2018-12-27

Description by

CVSS 3.1
7.5
High
MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions ASUSTOR ADM version 3.1.1
Description The issue allows attackers to upload files to arbitrary locations by modifying the path URL parameter in the upload.cgi. This can potentially lead to unauthorized access and modification of sensitive files.
Recommendations For ASUSTOR ADM version 3.1.1, consider restricting access to the upload.cgi until a patch is available. As a temporary workaround, avoid using the path URL parameter in the upload.cgi to minimize the risk of exploitation.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')
Related identifiers
CVE-2018-12309
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com