Lucene search

[email protected]CVE-2018-0496

HistoryJun 12, 2018 - 8:29 p.m.

CVE-2018-0496

2018-06-1220:29:00

CWE-22

[email protected]

web.nvd.nist.gov

cve-2018-0496

directory traversal

d-mod extractor

arbitrary file overwrite

dfarc

dfarc2

dink smallwood hd

protonsdk

6.4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

7.3 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

70.3%

JSON

Directory traversal issues in the D-Mod extractor in DFArc and DFArc2 (as well as in RTsoft’s Dink Smallwood HD / ProtonSDK version) before 3.14 allow an attacker to overwrite arbitrary files on the user’s system.

Affected configurations

NVD

Node

dinknetworkdfarcRange<3.14

dinknetworkdfarc2Range<3.14

Node

debiandebian_linuxMatch8.0

CPENameOperatorVersion
dinknetwork:dfarcdinknetwork dfarclt3.14
dinknetwork:dfarc2dinknetwork dfarc2lt3.14

CPE	Name	Operator	Version
dinknetwork:dfarc	dinknetwork dfarc	lt	3.14
dinknetwork:dfarc2	dinknetwork dfarc2	lt	3.14

CNA Affected

[
  {
    "product": "DFArc2 before 3.14 unknown",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "DFArc2 before 3.14 unknown"
      }
    ]
  }
]