9.8

CVE-2018-12596

Exploit
Episerver Ektron CMS before 9.0 SP3 Site CU 31, 9.1 before SP3 Site CU 45, or 9.2 before SP2 Site CU 22 allows remote attackers to call aspx pages via the "activateuser.aspx" page, even if a page is located under the /WorkArea/ path, which is forbidden (normally available exclusively for local admins).
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Episerver ≫ Ektron Cms Version9.00 Update-
Episerver ≫ Ektron Cms Version9.00 Updatesp1
Episerver ≫ Ektron Cms Version9.00 Updatesp2
Episerver ≫ Ektron Cms Version9.10 Update-
Episerver ≫ Ektron Cms Version9.10 Updatesp1
Episerver ≫ Ektron Cms Version9.10 Updatesp2
Episerver ≫ Ektron Cms Version9.20 Update-
Episerver ≫ Ektron Cms Version9.20 Updatesp1
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 47.92% 0.976
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

http://seclists.org/fulldisclosure/2018/Oct/15
Patch
Third Party Advisory
Exploit
Mailing List
Mitigation
https://github.com/alt3kx/CVE-2018-12596
Patch
Third Party Advisory
Exploit
https://www.exploit-db.com/exploits/45577/
Patch
Third Party Advisory
Exploit
VDB Entry
Mitigation