Path traversal in MDS PulseNET Enterprise and GE MDS PulseNET - CVE-2018-10615

Vulnerability identifier: #VU13124

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-10615

CWE-ID: CWE-23

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information on the target system.

The weakness exists due to path traversal. A remote attacker perform directory traversal attack and exfiltrate or delete data on the host platform.

MDS PulseNET Enterprise
GE MDS PulseNET
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power
Opensuse

Install update from vendor's website.

• https://ics-cert.us-cert.gov/advisories/ICSA-18-151-02

• Multiple vulnerabilities in GE MDS PulseNET and MDS PulseNET Enterprise
• OpenSUSE Linux update for python3
• Red Hat update for python