Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2018-10867

Опубликовано: 21 июн. 2018
Источник: redhat
CVSS3: 6.5
EPSS Низкий

Описание

Files are accessible without restrictions from the /update/results page of redhat-certification 7 package, allowing an attacker to remove any file accessible by the apached user.

It has been discovered that redhat-certification does not restrict file access in the /update/results page. A remote attacker could use this vulnerability to remove any file accessible by the user which is running httpd.

Меры по смягчению последствий

If SELinux is enabled, it will restrict the number of files accessible by the httpd process.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Certification for Red Hat Enterprise Linux 6redhat-certificationNot affected
Red Hat Certification for Red Hat Enterprise Linux 7redhat-certificationAffected

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-552
https://bugzilla.redhat.com/show_bug.cgi?id=1593764redhat-certification: /uploads/results page allows to remove files

EPSS

Процентиль: 56%
0.00341
Низкий

6.5 Medium

CVSS3

Связанные уязвимости

CVSS3: 9.1
nvd
больше 4 лет назад

Files are accessible without restrictions from the /update/results page of redhat-certification 7 package, allowing an attacker to remove any file accessible by the apached user.

CVSS3: 9.1
github
больше 3 лет назад

It has been discovered that redhat-certification does not restrict file access in the /update/results page. A remote attacker could use this vulnerability to remove any file accessible by the user which is running httpd. This flaw affects redhat-certification version 7.

EPSS

Процентиль: 56%
0.00341
Низкий

6.5 Medium

CVSS3