PT-2018-18205
CVE-2018-7679
·
Published
2018-06-21
·
Updated
2021-04-09
Description by
CVSS 3.1
9.8
CriticalMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Micro Focus Solutions Business Manager versions prior to 11.4
Description
The issue arises when ASP.NET is configured with execute permission on the virtual directories and does not validate the contents of user avatar images, which could lead to remote code execution.
Recommendations
For versions prior to 11.4, ensure that ASP.NET is configured to validate the contents of user avatar images and remove execute permission on the virtual directories to prevent remote code execution.
Found an issue in the description? Have something to add? Feel free to write us 👾