CVE-2018-9843

Опубликовано: 12 апр. 2018

Источник: nvd

CVSS3: 9.8

CVSS2: 7.5

EPSS Средний

Описание

The REST API in CyberArk Password Vault Web Access before 9.9.5 and 10.x before 10.1 allows remote attackers to execute arbitrary code via a serialized .NET object in an Authorization HTTP header.

Ссылки

http://seclists.org/fulldisclosure/2018/Apr/18
Exploit
Mailing List
Third Party Advisory
http://www.securityfocus.com/archive/1/541932/100/0/threaded
Exploit
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1040675
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/44429/
Exploit
Third Party Advisory
VDB Entry
https://www.redteam-pentesting.de/en/advisories/rt-sa-2017-014/-cyberark-password-vault-web-access-remote-code-execution
Exploit
Third Party Advisory
http://seclists.org/fulldisclosure/2018/Apr/18
Exploit
Mailing List
Third Party Advisory
http://www.securityfocus.com/archive/1/541932/100/0/threaded
Exploit
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1040675
Third Party Advisory
VDB Entry
https://www.exploit-db.com/exploits/44429/
Exploit
Third Party Advisory
VDB Entry
https://www.redteam-pentesting.de/en/advisories/rt-sa-2017-014/-cyberark-password-vault-web-access-remote-code-execution
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:cyberark:password_vault:*:*:*:*:*:*:*:*

Версия до 9.9.5 (исключая)

cpe:2.3:a:cyberark:password_vault:*:*:*:*:*:*:*:*

Версия от 10.0 (включая) до 10.1 (исключая)

EPSS

Процентиль: 96%

0.23987

Средний

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-502

Связанные уязвимости

GHSA-897c-mv4m-8fjj