Vulnerability CVE-2018-10201


Published: 2018-04-20

Description:
An issue was discovered in NcMonitorServer.exe in NC Monitor Server in NComputing vSpace Pro 10 and 11. It is possible to read arbitrary files outside the root directory of the web server. This vulnerability could be exploited remotely by a crafted URL without credentials, with .../ or ...\ or ..../ or ....\ as a directory-traversal pattern to TCP port 8667.

See advisories in our WLB2 database:
Topic
Author
Date
Med.
Ncomputing vSpace Pro v10 and v11 Directory Traversal PoC
Javier Bernardo
24.04.2018

Type:

CWE-22

(Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))

Vendor: Ncomputing
Product: Vspace pro 
Version: 11; 10;

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None

 References:
http://www.kwell.net/kwell_blog/?p=5199
https://support.ncomputing.com/portal/kb/articles/ncomputing-health-monitor-server-vulnerability-patch
https://www.exploit-db.com/exploits/44497/
https://www.kwell.net/kwell/index.php?option=com_newsfeeds&view=newsfeed&id=15&Itemid=173&lang=es

Copyright 2018, cxsecurity.com

 

Back to Top