Lucene search

Positive TechnologiesPT-2020-18

HistoryJan 09, 2018 - 12:00 a.m.

PT-2020-18: Arbitrary code execution via the TRACE protocol (r/w memory)

2018-01-0900:00:00

Positive Technologies

www.ptsecurity.com

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

6.8

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.003

Percentile

68.4%

JSON

PT-2020-18: Arbitrary code execution via the TRACE protocol (r/w memory)

Ingenico
Tellium 2

Severity level

Severity level: High
Impact: Arbitrary code execution via the TRACE protocol (r/w memory)
Access Vector: Remote

CVSS v3.1:
Base Score: 7.6
Vector: (AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

CVE-2018-17772

Advisory status

01.09.2018 - Vendor gets vulnerability details
01.03.2020 - Vendor releases fixed version and details

Credits

The vulnerability was detected by Dmitry Sklyarov, Alexey Stennikov, Vladimir Kononovich, Georgy Zaytsev, Maxim Kozhevnikov, Positive Research Center (Positive Technologies Company)

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

6.8

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.003

Percentile

68.4%

JSON

Related for PT-2020-18