CVE-2018-7669 (GCVE-0-2018-7669)
Vulnerability from cvelistv5 – Published: 2018-04-27 16:00 – Updated: 2024-08-05 06:31
VLAI?
Summary
An issue was discovered in Sitecore Sitecore.NET 8.1 rev. 151207 Hotfix 141178-1 and above. The 'Log Viewer' application is vulnerable to a directory traversal attack, allowing an attacker to access arbitrary files from the host Operating System using a sitecore/shell/default.aspx?xmlcontrol=LogViewerDetails&file= URI. Validation is performed to ensure that the text passed to the 'file' parameter correlates to the correct log file directory. This filter can be bypassed by including a valid log filename and then appending a traditional 'dot dot' style attack.
Severity ?
No CVSS data available.
CWE
- n/a
Assigner
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T06:31:04.994Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "45152",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/45152/"
},
{
"name": "20180424 Sitecore Directory Traversal Vulnerability",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2018/Apr/47"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://kb.sitecore.net/articles/356221"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-04-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "An issue was discovered in Sitecore Sitecore.NET 8.1 rev. 151207 Hotfix 141178-1 and above. The \u0027Log Viewer\u0027 application is vulnerable to a directory traversal attack, allowing an attacker to access arbitrary files from the host Operating System using a sitecore/shell/default.aspx?xmlcontrol=LogViewerDetails\u0026file= URI. Validation is performed to ensure that the text passed to the \u0027file\u0027 parameter correlates to the correct log file directory. This filter can be bypassed by including a valid log filename and then appending a traditional \u0027dot dot\u0027 style attack."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-08-10T09:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "45152",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/45152/"
},
{
"name": "20180424 Sitecore Directory Traversal Vulnerability",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2018/Apr/47"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://kb.sitecore.net/articles/356221"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-7669",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An issue was discovered in Sitecore Sitecore.NET 8.1 rev. 151207 Hotfix 141178-1 and above. The \u0027Log Viewer\u0027 application is vulnerable to a directory traversal attack, allowing an attacker to access arbitrary files from the host Operating System using a sitecore/shell/default.aspx?xmlcontrol=LogViewerDetails\u0026file= URI. Validation is performed to ensure that the text passed to the \u0027file\u0027 parameter correlates to the correct log file directory. This filter can be bypassed by including a valid log filename and then appending a traditional \u0027dot dot\u0027 style attack."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "45152",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/45152/"
},
{
"name": "20180424 Sitecore Directory Traversal Vulnerability",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2018/Apr/47"
},
{
"name": "https://kb.sitecore.net/articles/356221",
"refsource": "CONFIRM",
"url": "https://kb.sitecore.net/articles/356221"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-7669",
"datePublished": "2018-04-27T16:00:00",
"dateReserved": "2018-03-05T00:00:00",
"dateUpdated": "2024-08-05T06:31:04.994Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2018-7669\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2018-04-27T16:29:01.050\",\"lastModified\":\"2024-11-21T04:12:30.710\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"An issue was discovered in Sitecore Sitecore.NET 8.1 rev. 151207 Hotfix 141178-1 and above. The \u0027Log Viewer\u0027 application is vulnerable to a directory traversal attack, allowing an attacker to access arbitrary files from the host Operating System using a sitecore/shell/default.aspx?xmlcontrol=LogViewerDetails\u0026file= URI. Validation is performed to ensure that the text passed to the \u0027file\u0027 parameter correlates to the correct log file directory. This filter can be bypassed by including a valid log filename and then appending a traditional \u0027dot dot\u0027 style attack.\"},{\"lang\":\"es\",\"value\":\"Se ha descubierto un problema en Sitecore Sitecore.NET 8.1 rev. 151207 Hotfix 141178-1 y anteriores. La aplicaci\u00f3n \\\"Log Viewer\\\" es vulnerable a un ataque de salto de directorio que permite que un atacante acceda a archivos arbitrarios desde el sistema operativo del host mediante un URI sitecore/shell/default.aspx?xmlcontrol=LogViewerDetailsfile=. Se realiza validaci\u00f3n para asegurar que el texto que se pasa al par\u00e1metro \\\"file\\\" se correlaciona con el directorio de archivo de registro correcto. Este filtro puede ser omitido incluyendo un nombre de archivo de registro v\u00e1lido y, despu\u00e9s, a\u00f1adiendo un ataque tradicional de estilo \\\"punto punto\\\".\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:C/I:N/A:N\",\"baseScore\":7.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sitecore:sitecore.net:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.2\",\"matchCriteriaId\":\"B63EC1EF-1533-4424-A4F4-7AB100E97FB2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sitecore:sitecore.net:8.1:update1:*:*:*:*:*:*\",\"matchCriteriaId\":\"DC2A1105-4B1A-41FB-BDF2-27879231A376\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sitecore:sitecore.net:8.1:update2:*:*:*:*:*:*\",\"matchCriteriaId\":\"949E7547-0FA2-47DD-9046-EAF6B5117354\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:sitecore:sitecore.net:8.1:update3:*:*:*:*:*:*\",\"matchCriteriaId\":\"D6DDD83E-FBFC-4919-B2B2-2B84D3398D23\"}]}]}],\"references\":[{\"url\":\"http://seclists.org/fulldisclosure/2018/Apr/47\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://kb.sitecore.net/articles/356221\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.exploit-db.com/exploits/45152/\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://seclists.org/fulldisclosure/2018/Apr/47\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://kb.sitecore.net/articles/356221\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.exploit-db.com/exploits/45152/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…