Weaver E-cology 9.5 Unauthenticated Arbitrary File Read via XmlRpcServlet
63Vexday Risk Score
Prioriza la corrección. Ella explotación observada por VulnCheck y tiene prueba de concepto pública.
ssvc Actcvss 8.7epss 0.7%
de la publicación al arma
Publicada en NVD30 abr
VulnCheck30 abr
probabilidad de explotación
0.7%top 50% de las CVE
explotación observada
síVulnCheck
2 exploit(s) público(s)
Weaver (Fanwei) E-cology 9.5 versions prior to 10.52 contain an arbitrary file read vulnerability in the XmlRpcServlet interface at the XML-RPC endpoint that allows unauthenticated remote attackers to read arbitrary files by supplying file paths to the WorkflowService.getAttachment and WorkflowService.LoadTemplateProp methods. Attackers can exploit these methods without authentication to retrieve sensitive files including system configuration files and database credentials from the server. Exploitation evidence was first observed by the Shadowserver Foundation on 2022-12-14 (UTC).
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
Weaver Network Co., Ltd. · E-cologyPoCs públicas encontradas — 2
cve_referenceblog.csdn.net/qq_36618918/article/details/135104295no verificadocve_referenceblog.csdn.net/xiayu729100940/article/details/135205082no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
https://blog.csdn.net/qq_36618918/article/details/135104295https://blog.csdn.net/xiayu729100940/article/details/135205082https://www.cnvd.org.cn/flaw/show/CNVD-2022-43245https://www.vulncheck.com/advisories/weaver-e-cology-unauthenticated-arbitrary-file-read-via-xmlrpcservlethttps://www.weaver.com.cn/cs/ecology_full_log.htmlhttps://www.weaver.com.cn/cs/securityDownload.html#