#VU15327 Use of insufficiently random values in NUUO CMS - CVE-2018-17888
Published: October 11, 2018 / Updated: October 12, 2018
Vulnerability identifier: #VU15327
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber
CVE-ID: CVE-2018-17888
CWE-ID: CWE-330
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerable software:
NUUO CMS
NUUO CMS
Software vendor:
NUUO Inc.
NUUO Inc.
Description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to use of insufficiently random values by session identification mechanism. A remote unauthenticated attacker can obtain the active session ID and execute arbitrary code with elevated privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Remediation
Update to version 3.3 or later.