Vulnerability Details CVE-2018-11342
A path traversal vulnerability in fileExplorer.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to arbitrarily specify a path to a file on the system to create folders via the dest_folder parameter.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 53.8%
CVSS Severity
CVSS v3 Score 4.3
CVSS v2 Score 4.0
References
- http://seclists.org/fulldisclosure/2018/May/2
- https://github.com/mefulton/asustorexploit
- https://www.purehacking.com/blog/matthew-fulton/back-to-the-future-asustor-web-exploitation
- http://seclists.org/fulldisclosure/2018/May/2
- https://github.com/mefulton/asustorexploit
- https://www.purehacking.com/blog/matthew-fulton/back-to-the-future-asustor-web-exploitation
Products affected by CVE-2018-11342
-
cpe:2.3:h:asustor:as6202t:-
-
cpe:2.3:o:asustor:as6202t_firmware:-
-
cpe:2.3:o:asustor:as6202t_firmware:adm_3.1.0.rfq3