CVE-2018-14857

ALTO 8.8CVE-2018-14857 · Published 06/08/2018 · updated 17/06/2026

En resumen

CVE-2018-14857 es una vulnerabilidad ALTO (CVSS 8.8) que afecta a ocs inventory server (ocsinventory-ng).
Probabilidad de explotación en los próximos 30 días (EPSS): 3.6%, mayor que el 89.6% de las vulnerabilidades.
Aún no hay una versión corregida: sigue el aviso del fabricante en Referencias.

Package	Affected versions	Patched versions
ocs inventory server ocsinventory-ng	`≤ 2.5`	No fix yet

Description

Unrestricted file upload (with remote code execution) in require/mail/NotificationMail.php in Webconsole in OCS Inventory NG OCS Inventory Server through 2.5 allows a privileged user to gain access to the server via a template file containing PHP code, because file extensions other than .html are permitted.

References

seclists.org/fulldisclosure/2018/Aug/6 · Mailing List
securitytracker.com/id/1041418 · Third Party Advisory
OCSInventory-NG/OCSInventory-ocsreports commit cc57281 · Third Party Advisory

Más vulnerabilidades de ocs inventory server

Ver todo →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free