CVE-2018-9155

概要

参考情報

• docs.google.com/document/d/1ZG1qiwpECbVnv92yNckDn7yyuluKoC2_ON-eLhAY97Q/edit · Exploit
• exploit-db.com/exploits/44612 · Exploit

open-audit のその他の脆弱性

• CVE-2018-9137中 6.8Open-AudIT before 2.2 has CSV Injection.
• CVE-2018-8937中 6.1An issue was discovered in Open-AudIT Professional 2.1. It is possible to inject a malicious payload in the redirect_url parameter to the /l…
• CVE-2018-8979高 8.8Open-AudIT Professional 2.1 has CSRF, as demonstrated by modifying a user account or inserting XSS sequences via the credentials URI.
• CVE-2018-8978中 5.4Open-AudIT Professional 2.1 has XSS via a crafted src attribute of an IMG element within a URI.
• CVE-2018-8903中 5.4Open-AudIT Professional 2.1 allows XSS via the Name or Description field on the Credentials screen.