Improper input validation in Pydio

CVE-2018-1999018

Pydio version 8.2.1 and prior contains an Unvalidated user input leading to Remote Code Execution (RCE) vulnerability in plugins/action.antivirus/AntivirusScanner.php: Line 124, scanNow($nodeObject) that can result in An attacker gaining admin access and can then execute arbitrary commands on the underlying OS. This attack appear to be exploitable via The attacker edits the Antivirus Command in the antivirus plugin, and executes the payload by uploading any file within Pydio.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.035 (87.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.6 (Medium). Vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

  • Pydio
  • N/a — versions n/a

Weakness classification (CWE)

References

  • cve@mitre.org (Exploit, Third Party Advisory, x_refsource_MISC, Mitigation)

Frequently asked questions

What is CVE-2018-1999018?
CVE-2018-1999018 is a medium-severity vulnerability in Pydio, classified under Improper Input Validation. CVSS score: 6.6/10. Published 2018-07-23.
How severe is CVE-2018-1999018?
Medium severity. CVSS v3 base score is 6.6 out of 10.