CVE-2018-1000080
Severity Score
6.5
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Ajenti version version 2 contains a Insecure Permissions vulnerability in Plugins download that can result in The download of any plugins as being a normal user. This attack appear to be exploitable via By knowing how the requisition is made, and sending it as a normal user, the server, in response, downloads the plugin.
La versión 2 de Ajenti contiene una vulnerabilidad de permisos inseguros en la descarga de plugins que puede resultar en la descarga de cualquier plugin como un usuario normal. El ataque parece ser explotable si se sabe cómo se realiza la requisición y, al enviarlo como un usuario normal, el servidor descarga el plugin en respuesta.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2018-02-21 CVE Reserved
- 2018-03-13 CVE Published
- 2024-01-21 EPSS Updated
- 2024-08-05 CVE Updated
- 2024-08-05 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-732: Incorrect Permission Assignment for Critical Resource
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|---|---|
| https://medium.com/stolabs/security-issues-on-ajenti-d2b7526eaeee | 2024-08-05 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|