Nuuo Cms
CVE-2018-17892
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
NUUO CMS all versions 3.1 and prior, The application implements a method of user account control that causes standard account security features to not be utilized as intended, which could allow user account compromise and may allow for remote code execution.
AnalysisAI
NUUO CMS all versions 3.1 and prior, The application implements a method of user account control that causes standard account security features to not be utilized as intended, which could allow user. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. This Incorrect Permission Assignment vulnerability could allow attackers to access resources due to misconfigured permissions.
Technical ContextAI
This vulnerability is classified as Incorrect Permission Assignment (CWE-732), which allows attackers to access resources due to misconfigured permissions. NUUO CMS all versions 3.1 and prior, The application implements a method of user account control that causes standard account security features to not be utilized as intended, which could allow user account compromise and may allow for remote code execution. Affected products include: Nuuo Nuuo Cms.
RemediationAI
A vendor patch is available. Apply the latest security update as soon as possible. Review and restrict file/resource permissions, apply principle of least privilege.
NUUO CMS All versions 3.3 and prior the application allows the upload of arbitrary files that can modify or overwrite co
NUUO CMS All versions 3.3 and prior the web server application allows injection of arbitrary SQL characters, which can b
NUUO CMS All versions 3.3 and prior the application allows external input to construct a pathname that is able to be res
NUUO CMS all versions 3.1 and prior, The application uses a session identification mechanism that could allow attackers
NUUO CMS all versions 3.1 and prior, The application creates default accounts that have hard-coded passwords, which coul
NUUO CMS all versions 3.1 and prior, The application uses insecure and outdated software components for functionality, w
Share
External POC / Exploit Code
Leaving vuln.today