CVE-2018-9156

{"id": "CVE-2018-9156", "cveTags": [{"tags": ["disputed"], "sourceIdentifier": "cve@mitre.org"}], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "HIGH", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}]}, "published": "2018-04-01T18:29:00.350", "references": [{"url": "https://www.slideshare.net/secret/aewA1dZwZ9FQ8g", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.slideshare.net/secret/aewA1dZwZ9FQ8g", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered on AXIS P1354 (IP camera) Firmware version 5.90.1.1 devices. The upload web page doesn't verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server mod_include module with \"<!--#exec cmd=\" support. The file needs to include a specific string to meet the internal system architecture. After the webshell upload, an attacker can use the webshell to perform remote code execution such as running a system command (ls, ping, cat /etc/passwd, etc.). NOTE: the vendor reportedly indicates that this is an intended feature or functionality"}, {"lang": "es", "value": "** EN DISPUTA ** Se ha descubierto un problema en los dispositivos AXIS P1354 (c\u00e1mara IP) con versi\u00f3n de firmware 5.90.1.1. La p\u00e1gina web de subida no verifica el tipo de archivo y un atacante puede subir un webshell haciendo una petici\u00f3n fileUpload.shtml para un archivo .shtml personalizado, lo cual se interpreta en el m\u00f3dulo mod_include de Apache HTTP Server con soporte #exec cmd. El archivo necesita incluir una cadena espec\u00edfica para cumplir con la arquitectura interna del sistema. Despu\u00e9s de la carga del webshell, un atacante puede usar la webshell para realizar la ejecuci\u00f3n remota de c\u00f3digo, como ejecutar un comando del sistema (ls, ping, cat /etc/passwd, etc.). NOTA: el proveedor indica que se trata de una caracter\u00edstica o funcionalidad prevista."}], "lastModified": "2024-11-21T04:15:05.690", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:axis:p1354_firmware:5.90.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E91ADC73-C1C6-49B9-A638-8C7BDB4B7F3D"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:axis:p1354:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "325819D6-2655-4000-954E-974E1C64A0E9"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}