CVE-2018-11759
62Vexday Risk Score
Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.
ssvc Actepss 84%
da publicação à arma
Publicada no NVD31 de out.
VulnCheck+1875d
probabilidade de exploração
84%top 1% das CVEs
exploração observada
simVulnCheck
O que os fabricantes declaram (VEX)
Declarações oficiais dos fabricantes em formato CSAF/VEX: se o produto deles está afetado, já corrigido ou descartado — e por quê. É afirmação do fabricante, não juízo do Vexday.
Red Hatdocumento VEX ↗
Afetado
3 produtos
Red Hat JBoss Enterprise Application Platform 5 · Red Hat JBoss Enterprise Application Platform 6 · Red Hat JBoss Enterprise Web Server 2
no_fix_planned: Will not fix
Corrigido
3 produtos (139 componentes)
Red Hat JBoss Core Services on RHEL 6 Server · Red Hat JBoss Core Services on RHEL 7 Server · Text-Only JBCS
Não afetado
1 produto — porque o código vulnerável não está presente no produto
Red Hat JBoss Web Server 3
The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly. If only a sub-set of the URLs supported by Tomcat were exposed via httpd, then it was possible for a specially constructed request to expose application functionality through the reverse proxy that was not intended for clients accessing the application via the reverse proxy. It was also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is some overlap between this issue and CVE-2018-1323, they are not identical.
Produtos afetados
Apache Software Foundation · Apache Tomcat ConnectorsReferências
https://access.redhat.com/errata/RHSA-2019:0366https://access.redhat.com/errata/RHSA-2019:0367https://lists.apache.org/thread.html/277d42b48b6e9aef50949c0dcc79ce21693091d73da246b3c1981925%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/5b7a23e245c93235c503900da854a143596d901bf1a1f67e851a5de4%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/6d564bb0ab73d6b3efdd1d6b1c075d1a2c84ecd84a4159d6122529ad%40%3Cannounce.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/8d2a579bbd977c225c70cb23b0ec54865fb0dab5da3eff1e060c9935%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/ba661b0edd913b39ff129a32d855620dd861883ade05fd88a8ce517d%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/r5c616dfc49156e4b06ffab842800c80f4425924d0f20c452c127a53c%40%3Cdev.tomcat.apache.org%3Ehttps://lists.apache.org/thread.html/rf8e8c091182b45daa50d3557cad9b10bb4198e3f08cf8f1c66a1b08d%40%3Cdev.tomcat.apache.org%3Ehttps://lists.debian.org/debian-lts-announce/2018/12/msg00007.htmlhttps://www.debian.org/security/2018/dsa-4357https://www.oracle.com/security-alerts/cpujan2020.html