CVE-2018-20732

Опубликовано: 17 янв. 2019

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Низкий

Описание

SAS Web Infrastructure Platform before 9.4M6 allows remote attackers to execute arbitrary code via a Java deserialization variant.

Ссылки

http://www.securityfocus.com/bid/106648
Third Party Advisory
VDB Entry
https://support.sas.com/kb/63/391.html
Vendor Advisory
http://www.securityfocus.com/bid/106648
Third Party Advisory
VDB Entry
https://support.sas.com/kb/63/391.html
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:a:sas:web_infrastructure_platform:*:*:*:*:*:*:*:*

Версия до 9.4 (исключая)

cpe:2.3:a:sas:web_infrastructure_platform:9.4:-:*:*:*:*:*:*

cpe:2.3:a:sas:web_infrastructure_platform:9.4:maintenance_release_1:*:*:*:*:*:*

cpe:2.3:a:sas:web_infrastructure_platform:9.4:maintenance_release_2:*:*:*:*:*:*

cpe:2.3:a:sas:web_infrastructure_platform:9.4:maintenance_release_3:*:*:*:*:*:*

cpe:2.3:a:sas:web_infrastructure_platform:9.4:maintenance_release_4:*:*:*:*:*:*

cpe:2.3:a:sas:web_infrastructure_platform:9.4:maintenance_release_5:*:*:*:*:*:*

Одно из

cpe:2.3:a:hpe:hp-ux_ipfilter:-:*:*:*:*:*:*:*

cpe:2.3:o:ibm:aix:-:*:*:*:*:*:x64:*

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:x64:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:x64:*

cpe:2.3:o:oracle:solaris:-:*:*:*:*:*:x64:*

EPSS

Процентиль: 89%

0.04279

Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-502

Связанные уязвимости

GHSA-92hw-4jvj-v9ww