CVE-2018-5716

{"id": "CVE-2018-5716", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 8.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:N", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 9.2, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}]}, "published": "2018-02-21T15:29:00.633", "references": [{"url": "http://www.0x90.zone/web/path-traversal/2018/02/16/Path-Traversal-Reprise-LM.html", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Reprise License Manager 11.0. This vulnerability is a Path Traversal where the attacker, by changing a field in the Web Request, can have access to files on the File System of the Server. By specifying a pathname in the POST parameter \"lf\" to the goform/edit_lf_get_data URI, the attacker can retrieve the content of a file."}, {"lang": "es", "value": "Se ha descubierto un problema en Reprise License Manager 11.0. La vulnerabilidad es un salto de directorio en el que el atacante, al cambiar un campo en la petici\u00f3n web, puede tener acceso a archivos en el sistema de archivos del servidor. Al especificar un nombre de ruta en el par\u00e1metro POST \"If\" en el URI goform/edit_lf_get_data, el atacante puede recuperar el contenido de un archivo."}], "lastModified": "2018-03-18T14:02:26.547", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:reprisesoftware:reprise_license_manager:11.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C20627F3-ECAC-46EB-87E5-E5CA6F779F62"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}