CVE-2018-15486

Опубликовано: 07 сент. 2018

Источник: nvd

CVSS3: 9.1

CVSS2: 6.4

EPSS Низкий

Описание

An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. Unauthenticated Local File Inclusion and File modification is possible through the open HTTP interface by modifying the name parameter of the file endpoint, aka KONE-02.

Ссылки

http://packetstormsecurity.com/files/149252/KONE-KGC-4.6.4-DoS-Code-Execution-LFI-Bypass.html
Exploit
Third Party Advisory
VDB Entry
https://www.kone.com/en/vulnerability.aspx
Vendor Advisory
http://packetstormsecurity.com/files/149252/KONE-KGC-4.6.4-DoS-Code-Execution-LFI-Bypass.html
Exploit
Third Party Advisory
VDB Entry
https://www.kone.com/en/vulnerability.aspx
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:kone:group_controller_firmware:*:*:*:*:*:*:*:*

Версия до 4.6.5 (исключая)

cpe:2.3:h:kone:group_controller:-:*:*:*:*:*:*:*

EPSS

Процентиль: 51%

0.00275

Низкий

9.1 Critical

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-829

Связанные уязвимости

GHSA-f9xh-5xh7-49g5