Use of insufficiently random values in NUUO CMS - CVE-2018-17888
Published: October 11, 2018 / Updated: October 12, 2018
Vulnerability identifier: #VU15327
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber
CVE-ID: CVE-2018-17888
CWE-ID: CWE-330
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vendor: NUUO Inc.
Affected software:
NUUO CMS
NUUO CMS
Detailed vulnerability description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to use of insufficiently random values by session identification mechanism. A remote unauthenticated attacker can obtain the active session ID and execute arbitrary code with elevated privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
How to mitigate CVE-2018-17888
Update to version 3.3 or later.