CVE-2018-10867

CWE-552 — Files Accessible to External Parties5 documents5 sources
Severity
9.1CRITICAL
EPSS
0.3%
top 43.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Redhat Certification
Timeline
PublishedMay 26
Latest updateMay 24

Description

Files are accessible without restrictions from the /update/results page of redhat-certification 7 package, allowing an attacker to remove any file accessible by the apached user.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:HExploitability: 3.9 | Impact: 5.2

Affected Packages2 packages

▶CVEListV5redhat-certificationredhat-certification 7

🔴Vulnerability Details

2
GHSA
GHSA-fxc4-ggqh-5wg4: It has been discovered that redhat-certification does not restrict file access in the /update/results page↗2022-05-24
▶
CVEList
CVE-2018-10867: Files are accessible without restrictions from the /update/results page of redhat-certification 7 package, allowing an attacker to remove any file acc↗2021-05-26
▶

📋Vendor Advisories

1
Red Hat
redhat-certification: /uploads/results page allows to remove files↗2018-06-21
▶

💬Community

1
Bugzilla
CVE-2018-10867 redhat-certification: /uploads/results page allows to remove files↗2018-06-21
▶
CVE-2018-10867 (CRITICAL CVSS 9.1) | Files are accessible without restri | cvebase.io