CVE-2018-1000882 Path traversal in n/a

High 7.5 Published 20 Dec 2018 Updated 17 Sep 2024

Attackers can read arbitrary image files from the server via a directory traversal flaw in WeBid's getthumb.php script.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-1000882?

CVE-2018-1000882 is a high-severity path traversal vulnerability in n/a, published on 20 Dec 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

WeBid version up to current version 1.2.2 contains a Directory Traversal vulnerability in getthumb.php that can result in Arbitrary Image File Read. This attack appear to be exploitable via HTTP GET Request. This vulnerability appears to have been fixed in after commit 256a5f9d3eafbc477dcf77c7682446cc4b449c7f.

Weakness: CWE-22

Which versions are affected by CVE-2018-1000882?

It affects 1 product.

Products include Webidsupport Webid.

How do I fix CVE-2018-1000882?

No fix has been published for CVE-2018-1000882 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2018-1000882 being exploited?

There is no known exploitation of CVE-2018-1000882 in the wild and no public exploit code.

Sources

Also known as GHSA-hjch-cqpr-8pfq.