CVE-2018-18593 MFSBGN03838 rev.1 - UCMDB Configuration Management Service, Multiple Vulnerabilities
Remote attackers can exploit directory traversal to disclose privileged information in Micro Focus UCMDB Configuration Management Service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-18593?
CVE-2018-18593 is a medium-severity path traversal vulnerability in Micro Focus UCMDB Configuration Management Service, published on 31 Dec 2018. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Remote Directory Traversal and Remote Disclosure of Privileged Information in UCMDB Configuration Management Service, version 10.22, 10.22 CUP1, 10.22 CUP2, 10.22 CUP3, 10.22 CUP4, 10.22 CUP5, 10.22 CUP6, 10.22 CUP7, 10.33, 10.33 CUP1, 10.33 CUP2, 10.33 CUP3, 2018.02, 2018.05, 2018.08, 2018.11. The vulnerabilities could allow Remote Directory Traversal and Remote Disclosure of Privileged Information
Weakness: CWE-22
Which versions are affected by CVE-2018-18593?
It affects 1 product.
Products include Hp Ucmdb Configuration Manager.
How do I fix CVE-2018-18593?
No fix has been published for CVE-2018-18593 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2018-18593 being exploited?
There is no known exploitation of CVE-2018-18593 in the wild and no public exploit code.
Other vulnerabilities in Micro Focus UCMDB Configuration Management Service
Sources
Also known as GHSA-v7cj-g3gx-p5gf.