CVE-2018-9023

Una vulnerabilidad de validación de entradas en las versiones 2.x de CA Privileged Access Manager permite que usuarios sin privilegios ejecuten comandos arbitrarios pasando argumentos especialmente manipulados al script update_crld.

CA Technologies Support is alerting customers to multiple potential risks with CA Privileged Access Manager. Multiple vulnerabilities exist that can allow a remote attacker to conduct a variety of attacks. These risks include seven vulnerabilities privately reported within the past year to CA Technologies by security researchers, and nine vulnerabilities for Xceedium Xsuite that were publicly disclosed in July 2015. CA Technologies acquired Xceedium in August 2015, and Xceedium products were renamed and became part of Privileged Access Management solutions from CA Technologies. Sixteen vulnerabilities are outlined in this advisory.