CVE-2018-14043 Missing authorization in n/a
An attacker can read sensitive data by exploiting incorrect file access controls during copy operations in the mstdlib C library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-14043?
CVE-2018-14043 is a critical missing authorization vulnerability in n/a, published on 13 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
mstdlib (aka the M Standard Library for C) 1.2.0 has incorrect file access control in situations where M_fs_perms_can_access attempts to delete an existing file (that lacks public read/write access) during a copy operation, related to fs/m_fs.c and fs/m_fs_path.c. An attacker could create the file and then would have access to the data.
Weakness: CWE-732
Which versions are affected by CVE-2018-14043?
It affects 1 product.
Products include Monetra Mstdlib.
How do I fix CVE-2018-14043?
No fix has been published for CVE-2018-14043 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2018-14043 being exploited?
There is no known exploitation of CVE-2018-14043 in the wild and no public exploit code.
Sources
Also known as GHSA-h432-5g5p-5gfj.