CVE-2018-18552 Path traversal in n/a

Medium 6.5 Published 24 Oct 2018 Updated 5 Aug 2024

Local attackers can cause denial of service by exploiting a path traversal vulnerability to create empty files in arbitrary directories.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-18552?

CVE-2018-18552 is a medium-severity path traversal vulnerability in n/a, published on 24 Oct 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

ServersCheck Monitoring Software through 14.3.3 allows local users to cause a denial of service (menu functionality loss) by creating an LNK file that points to a second LNK file, if this second LNK file is associated with a Start menu. Ultimately, this behavior comes from a Directory Traversal bug (via the sensor_details.html id parameter) that allows creating empty files in arbitrary directories.

Weakness: CWE-22

Which versions are affected by CVE-2018-18552?

It affects 1 product.

Products include Serverscheck Monitoring Software.

How do I fix CVE-2018-18552?

No fix has been published for CVE-2018-18552 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2018-18552 being exploited?

There is no known exploitation of CVE-2018-18552 in the wild and no public exploit code.

Sources

Also known as GHSA-gwfq-r26j-c4v4.