Nuuo Cms
CVE-2018-17890
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
NUUO CMS all versions 3.1 and prior, The application uses insecure and outdated software components for functionality, which could allow arbitrary code execution.
AnalysisAI
NUUO CMS all versions 3.1 and prior, The application uses insecure and outdated software components for functionality, which could allow arbitrary code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Technical ContextAI
This vulnerability is classified under CWE-477. NUUO CMS all versions 3.1 and prior, The application uses insecure and outdated software components for functionality, which could allow arbitrary code execution. Affected products include: Nuuo Nuuo Cms.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
NUUO CMS All versions 3.3 and prior the application allows the upload of arbitrary files that can modify or overwrite co
NUUO CMS All versions 3.3 and prior the web server application allows injection of arbitrary SQL characters, which can b
NUUO CMS All versions 3.3 and prior the application allows external input to construct a pathname that is able to be res
NUUO CMS all versions 3.1 and prior, The application uses a session identification mechanism that could allow attackers
NUUO CMS all versions 3.1 and prior, The application creates default accounts that have hard-coded passwords, which coul
NUUO CMS all versions 3.1 and prior, The application implements a method of user account control that causes standard ac
Same weakness CWE-477 – Use of Obsolete Function
View allShare
External POC / Exploit Code
Leaving vuln.today