Improper input validation in Pydio
CVE-2018-1999018
Pydio version 8.2.1 and prior contains an Unvalidated user input leading to Remote Code Execution (RCE) vulnerability in plugins/action.antivirus/AntivirusScanner.php: Line 124, scanNow($nodeObject) that can result in An attacker gaining admin access and can then execute arbitrary commands on the underlying OS. This attack appear to be exploitable via The attacker edits the Antivirus Command in the antivirus plugin, and executes the payload by uploading any file within Pydio.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.6 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.035 (88.8th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 89th percentile — 88.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.035 · newest: 0.035 · change: 0.000
Affected products
Weakness classification (CWE)
References
- www.mike-gualtieri.com/files/Pydio-8-VulnerabilityDisclosure-Jul18.txt (Exploit, Third Party Advisory, Mitigation)
Frequently asked questions
- What is CVE-2018-1999018?
- CVE-2018-1999018 is a medium-severity vulnerability in Pydio, classified under Improper Input Validation. CVSS score: 6.6/10. Published 2018-07-23.
- How severe is CVE-2018-1999018?
- Medium severity. CVSS v3 base score is 6.6 out of 10.