CVE-2018-10057

Опубликовано: 05 июн. 2018

Источник: nvd

CVSS3: 6.5

CVSS2: 4

EPSS Низкий

Описание

The remote management interface of cgminer 4.10.0 and bfgminer 5.5.0 allows an authenticated remote attacker to write the miner configuration file to arbitrary locations on the server due to missing basedir restrictions (absolute directory traversal).

Ссылки

http://www.openwall.com/lists/oss-security/2018/06/03/1
Mailing List
Third Party Advisory
https://github.com/tintinweb/pub/tree/master/pocs/cve-2018-10057
Exploit
Third Party Advisory
http://www.openwall.com/lists/oss-security/2018/06/03/1
Mailing List
Third Party Advisory
https://github.com/tintinweb/pub/tree/master/pocs/cve-2018-10057
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:bfgminer:bfgminer:5.5.0:*:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:a:cgminer_project:cgminer:4.10.0:*:*:*:*:*:*:*

EPSS

Процентиль: 66%

0.00527

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-22

Связанные уязвимости

CVE-2018-10057

CVSS3: 6.5

ubuntu

больше 7 лет назад

CVE-2018-10057

CVSS3: 6.5

debian

больше 7 лет назад

The remote management interface of cgminer 4.10.0 and bfgminer 5.5.0 a ...

GHSA-7fj2-f693-x66w

CVSS3: 6.5

github

больше 3 лет назад

EPSS

Процентиль: 66%

0.00527

Низкий

6.5 Medium

CVSS3

4 Medium

CVSS2

Дефекты

CWE-22