CVE-2018-9074

  1. Reconshell
  2. Vulnerabilities (CVE)
  3. CVE-2018-9074
For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file upload functionality of the Content Explorer application is vulnerable to path traversal. As a result, users can upload files anywhere on the device's operating system as the root user.

6.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

6.8 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:N/I:C/A:N

Exploitability : 8.0 / Impact : 6.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact COMPLETE

Availability Impact NONE

References
Link Resource
https://support.lenovo.com/us/en/solutions/LEN-24224 Vendor Advisory
Advertisement

NeevaHost hosting service
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:lenovo:lenovoemc_firmware:*:*:*:*:*:*:*:*
OR cpe:2.3:h:lenovo:iomega_storcenter_px12-400r:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:iomega_storcenter_px4-300r:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:iomega_storcenter_px6-300d:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:iomega_storcenter_px4-300d:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:lenovoemc_px4-400r:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:lenovoemc_px12-400r:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:lenovoemc_px12-450r:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:iomega_ez_media_\&_backup_center:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:lenovo_ix4-300d:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:lenovo_ix2:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:lenovo_ez_media_\&_backup_center:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:iomega_storcenter_px12-450r:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:iomega_storcenter_px2-300d:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:iomega_storcenter_ix4-300d:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:iomega_storcenter_ix2:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:iomega_storcenter_ix2-dl:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:lenovoemc_px2-300d:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:lenovoemc_px4-300d:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:lenovoemc_px4-400d:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:lenovoemc_px6-300d:-:*:*:*:*:*:*:*
cpe:2.3:h:lenovo:lenovoemc_px4-300r:-:*:*:*:*:*:*:*
Information

Published : 2018-09-28 13:29

Updated : 2018-11-20 08:57

NVD link : CVE-2018-9074

Mitre link : CVE-2018-9074

JSON object : View

CWE
CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Advertisement

dedicated server usa
Products Affected

lenovo

  • lenovoemc_px4-300d
  • iomega_storcenter_px2-300d
  • lenovoemc_firmware
  • iomega_storcenter_ix2
  • lenovoemc_px6-300d
  • iomega_storcenter_px12-400r
  • lenovo_ix4-300d
  • lenovoemc_px2-300d
  • lenovoemc_px4-300r
  • lenovo_ix2
  • iomega_storcenter_px4-300r
  • iomega_storcenter_ix2-dl
  • lenovoemc_px4-400d
  • lenovo_ez_media_\&_backup_center
  • iomega_storcenter_px4-300d
  • iomega_storcenter_px12-450r
  • lenovoemc_px12-450r
  • lenovoemc_px4-400r
  • iomega_storcenter_px6-300d
  • lenovoemc_px12-400r
  • iomega_storcenter_ix4-300d
  • iomega_ez_media_\&_backup_center