CVE-2018-17892
published 2018-10-12CVE-2018-17892: NUUO CMS all versions 3.1 and prior, The application implements a method of user account control that causes standard account security features to not be…
PriorityP353high8.8CVSS 3.0
AVNACLPRLUINSUCHIHAH
EPSS
2.78%
84.6th percentile
NUUO CMS all versions 3.1 and prior, The application implements a method of user account control that causes standard account security features to not be utilized as intended, which could allow user account compromise and may allow for remote code execution.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nuuo | nuuo_cms | <= 3.1 | — |
| nuuo | nuuo_cms | — | — |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
NUUO CMS (Update A)
cisa_ics·2018-10-11·CVSS 9.8
[CRITICAL] NUUO CMS (Update A)
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
NUUO CMS (Update A)
Last RevisedNovember 20, 2018
Alert CodeICSA-18-284-02
## 1. EXECUTIVE SUMMARY
-
CVSS v3 9.8
- ATTENTION: Exploitable remotely/low skill level to exploit
- Vendor: NUUO
- Equipment: CMS
--------- Begin Update A Part 1 of 3 --------
- Vulnerabilities: Use of Insufficiently Random Values, Use of Obsolete Function, Incorrect Permission Assignment for Critical Resource, Use of Hard-coded Credentials, Path Traversal, Unrestricted Upload of File with Dangerous Type, SQL Injection
--------- End Update A Part 1 of 3 ----------
## 2. UPDATE INFORMATION
This up
GHSA
GHSA-7vv5-mw7c-2m78: NUUO CMS all versions 3
ghsa_unreviewed·2022-05-13
CVE-2018-17892 [HIGH] GHSA-7vv5-mw7c-2m78: NUUO CMS all versions 3
NUUO CMS all versions 3.1 and prior, The application implements a method of user account control that causes standard account security features to not be utilized as intended, which could allow user account compromise and may allow for remote code execution.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2018-10-12
Published