6.8

CVE-2018-9074

Iomega and LenovoEMC NAS Web UI Vulnerabilities

For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file upload functionality of the Content Explorer application is vulnerable to path traversal. As a result, users can upload files anywhere on the device's operating system as the root user.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Lenovo ≫ Lenovoemc Firmware Version <= 4.1.402.34662
   Lenovo ≫ Iomega Ez Media & Backup Center Version-
   Lenovo ≫ Iomega Storcenter Ix2 Version-
   Lenovo ≫ Iomega Storcenter Ix2-dl Version-
   Lenovo ≫ Iomega Storcenter Ix4-300d Version-
   Lenovo ≫ Iomega Storcenter Px12-400r Version-
   Lenovo ≫ Iomega Storcenter Px12-450r Version-
   Lenovo ≫ Iomega Storcenter Px2-300d Version-
   Lenovo ≫ Iomega Storcenter Px4-300d Version-
   Lenovo ≫ Iomega Storcenter Px4-300r Version-
   Lenovo ≫ Iomega Storcenter Px6-300d Version-
   Lenovo ≫ Lenovo Ez Media & Backup Center Version-
   Lenovo ≫ Lenovo Ix2 Version-
   Lenovo ≫ Lenovo Ix4-300d Version-
   Lenovo ≫ Lenovoemc Px12-400r Version-
   Lenovo ≫ Lenovoemc Px12-450r Version-
   Lenovo ≫ Lenovoemc Px2-300d Version-
   Lenovo ≫ Lenovoemc Px4-300d Version-
   Lenovo ≫ Lenovoemc Px4-300r Version-
   Lenovo ≫ Lenovoemc Px4-400d Version-
   Lenovo ≫ Lenovoemc Px4-400r Version-
   Lenovo ≫ Lenovoemc Px6-300d Version-
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.34% 0.539
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov 6.8 8 6.9
AV:N/AC:L/Au:S/C:N/I:C/A:N
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.