CVE-2018-25113highCWE-22

CVE-2018-25113: fallo de gravedad alta en Dicoogle Project PACS Web Server

Dicoogle PACS Web Server 2.5.0 Unauthenticated Path Traversal

Publicada el · Actualizada el

36Vexday Risk Score

Corrige pronto. Ella tiene exploit funcional público.

ssvc Attendcvss 8.7epss 1.7%
de la publicación al arma0 días
Publicada en NVD23 jul
metasploit11 jul
probabilidad de explotación
1.7%top 23% de las CVE
explotación observada
noninguna fuente lo reporta
An unauthenticated path traversal vulnerability exists in Dicoogle PACS Web Server version 2.5.0 and possibly earlier. The vulnerability allows remote attackers to read arbitrary files on the underlying system by sending a crafted request to the /exportFile endpoint using the UID parameter. Successful exploitation can reveal sensitive files accessible by the web server user.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
Dicoogle Project · PACS Web Server
Referencias
https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/dicoogle_traversal.rbhttps://www.exploit-db.com/exploits/45007https://www.fortiguard.com/encyclopedia/ips/46527/dicoogle-pacs-web-server-directory-traversalhttps://www.vulncheck.com/advisories/dicoogle-pacs-web-server-path-traversal