CVE-2018-4031

CRITICAL

10.0

Description

An exploitable vulnerability exists in the safe browsing function of the CUJO Smart Firewall, version 7003. The flaw lies in the way the safe browsing function parses HTTP requests. The server hostname is extracted from captured HTTP/HTTPS requests and inserted as part of a Lua statement without prior sanitization, which results in arbitrary Lua script execution in the kernel. An attacker could send an HTTP request to exploit this vulnerability.

Details CVE

Score CVSS v3.110.0

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie10/31/2019

Derniere modification11/21/2024

Sourcenvd

Observations honeypot0

Produits affectes

getcujo:smart_firewall

Faiblesses (CWE)

CWE-94

References

https://talosintelligence.com/vulnerability_reports/TALOS-2018-0703(talos-cna@cisco.com)

https://talosintelligence.com/vulnerability_reports/TALOS-2018-0703(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.