var-201811-0095
Vulnerability from variot
NUUO CMS All versions 3.3 and prior the application allows the upload of arbitrary files that can modify or overwrite configuration files to the server, which could allow remote code execution. NUUO CMS Contains a vulnerability related to unlimited uploads of dangerous types of files.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. NUUO CMS is a central software management platform of NUUO. The platform is used to centrally manage NVR (hard disk video recorders), IP cameras and other equipment, and provides functions such as user management and alarm management.
There are security vulnerabilities in NUUO CMS 3.3 and earlier versions
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201811-0095",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "cms",
"scope": "lte",
"trust": 1.8,
"vendor": "nuuo",
"version": "3.3"
},
{
"model": "cms",
"scope": "lte",
"trust": 0.6,
"vendor": "nuuo",
"version": "\u003c=3.3"
},
{
"model": "cms",
"scope": "eq",
"trust": 0.6,
"vendor": "nuuo",
"version": "3.3"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "nuuo cms",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "e30160de-39ab-11e9-b7a4-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-24251"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012290"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-799"
},
{
"db": "NVD",
"id": "CVE-2018-17936"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:nuuo:nuuo_cms",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-012290"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Pedro Ribeiro",
"sources": [
{
"db": "PACKETSTORM",
"id": "151260"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-799"
}
],
"trust": 0.7
},
"cve": "CVE-2018-17936",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2018-17936",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2018-24251",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "e30160de-39ab-11e9-b7a4-000c29342cb1",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2018-17936",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2018-17936",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2018-17936",
"trust": 0.8,
"value": "Critical"
},
{
"author": "CNVD",
"id": "CNVD-2018-24251",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201811-799",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "IVD",
"id": "e30160de-39ab-11e9-b7a4-000c29342cb1",
"trust": 0.2,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "e30160de-39ab-11e9-b7a4-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-24251"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012290"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-799"
},
{
"db": "NVD",
"id": "CVE-2018-17936"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "NUUO CMS All versions 3.3 and prior the application allows the upload of arbitrary files that can modify or overwrite configuration files to the server, which could allow remote code execution. NUUO CMS Contains a vulnerability related to unlimited uploads of dangerous types of files.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. NUUO CMS is a central software management platform of NUUO. The platform is used to centrally manage NVR (hard disk video recorders), IP cameras and other equipment, and provides functions such as user management and alarm management. \n\r\n\r\nThere are security vulnerabilities in NUUO CMS 3.3 and earlier versions",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-17936"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012290"
},
{
"db": "CNVD",
"id": "CNVD-2018-24251"
},
{
"db": "IVD",
"id": "e30160de-39ab-11e9-b7a4-000c29342cb1"
}
],
"trust": 2.34
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-17936",
"trust": 3.3
},
{
"db": "ICS CERT",
"id": "ICSA-18-284-02",
"trust": 2.4
},
{
"db": "CNVD",
"id": "CNVD-2018-24251",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201811-799",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012290",
"trust": 0.8
},
{
"db": "PACKETSTORM",
"id": "151781",
"trust": 0.6
},
{
"db": "IVD",
"id": "E30160DE-39AB-11E9-B7A4-000C29342CB1",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "151260",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "e30160de-39ab-11e9-b7a4-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-24251"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012290"
},
{
"db": "PACKETSTORM",
"id": "151260"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-799"
},
{
"db": "NVD",
"id": "CVE-2018-17936"
}
]
},
"id": "VAR-201811-0095",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "e30160de-39ab-11e9-b7a4-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-24251"
}
],
"trust": 1.4363636
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "e30160de-39ab-11e9-b7a4-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-24251"
}
]
},
"last_update_date": "2024-11-23T22:30:16.676000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Central Management System",
"trust": 0.8,
"url": "https://www.nuuo.com/ProductNode.php?node=3"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-012290"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-434",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-012290"
},
{
"db": "NVD",
"id": "CVE-2018-17936"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "https://ics-cert.us-cert.gov/advisories/icsa-18-284-02"
},
{
"trust": 1.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-17936"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-17936"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/151781/nuuo-central-management-server-2.4-authenticated-arbitrary-file-upload.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-17888"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-17890"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-17892"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-17934"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-17894"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-18982"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-24251"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012290"
},
{
"db": "PACKETSTORM",
"id": "151260"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-799"
},
{
"db": "NVD",
"id": "CVE-2018-17936"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "e30160de-39ab-11e9-b7a4-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-24251"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012290"
},
{
"db": "PACKETSTORM",
"id": "151260"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-799"
},
{
"db": "NVD",
"id": "CVE-2018-17936"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-11-29T00:00:00",
"db": "IVD",
"id": "e30160de-39ab-11e9-b7a4-000c29342cb1"
},
{
"date": "2018-11-29T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-24251"
},
{
"date": "2019-01-31T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-012290"
},
{
"date": "2019-01-21T23:02:22",
"db": "PACKETSTORM",
"id": "151260"
},
{
"date": "2018-11-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201811-799"
},
{
"date": "2018-11-27T20:29:00.893000",
"db": "NVD",
"id": "CVE-2018-17936"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-03-10T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-24251"
},
{
"date": "2019-01-31T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-012290"
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201811-799"
},
{
"date": "2024-11-21T03:55:14.620000",
"db": "NVD",
"id": "CVE-2018-17936"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "151260"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-799"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "NUUO CMS Vulnerable to unlimited upload of dangerous types of files",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-012290"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Code problem",
"sources": [
{
"db": "IVD",
"id": "e30160de-39ab-11e9-b7a4-000c29342cb1"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-799"
}
],
"trust": 0.8
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.