Vulnerability Details CVE-2018-11346
An insecure direct object reference vulnerability in download.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows the ability to reference the "download_sys_settings" action and then specify files arbitrarily throughout the system via the act parameter.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 36.6%
CVSS Severity
CVSS v3 Score 4.3
CVSS v2 Score 4.0
References
- http://seclists.org/fulldisclosure/2018/May/2
- https://github.com/mefulton/asustorexploit
- https://www.purehacking.com/blog/matthew-fulton/back-to-the-future-asustor-web-exploitation
- http://seclists.org/fulldisclosure/2018/May/2
- https://github.com/mefulton/asustorexploit
- https://www.purehacking.com/blog/matthew-fulton/back-to-the-future-asustor-web-exploitation
Products affected by CVE-2018-11346
-
cpe:2.3:h:asustor:as6202t:-
-
cpe:2.3:o:asustor:as6202t_firmware:-
-
cpe:2.3:o:asustor:as6202t_firmware:adm_3.1.0.rfq3