Details of VAR-201812-0853

ID

VAR-201812-0853

CVE

CVE-2018-7836

TITLE

IIoT Monitor Vulnerable to unlimited upload of dangerous types of files

Trust: 0.8

sources: JVNDB: JVNDB-2018-014342

DESCRIPTION

An unrestricted Upload of File with Dangerous Type vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow upload and execution of malicious files. IIoT Monitor Contains a vulnerability related to unlimited uploads of dangerous types of files.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Schneider Electric IIoT Monitor. Authentication is required to exploit this vulnerability but authentication can be easily bypassed.The specific flaw exists within the processing of the upload method of the ProtectionMgmt servlet. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Schneider Electric IIoT Monitor is an industrial IoT monitor from Schneider Electric of France. A directory-traversal vulnerability 2. An arbitrary file-upload vulnerability 3

Trust: 6.21

sources: NVD: CVE-2018-7836 // JVNDB: JVNDB-2018-014342 // ZDI: ZDI-19-032 // ZDI: ZDI-19-022 // ZDI: ZDI-19-030 // ZDI: ZDI-19-021 // ZDI: ZDI-19-029 // CNVD: CNVD-2019-03464 // CNNVD: CNNVD-201812-1096 // BID: 106484 // VULMON: CVE-2018-7836

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2019-03464

AFFECTED PRODUCTS

vendor:	schneider electric	model:	iiot monitor	scope:	-	version:	-	Trust: 3.5
vendor:	schneider electric	model:	iiot monitor	scope:	eq	version:	3.1.38	Trust: 2.1
vendor:	schneider	model:	electric iiot monitor	scope:	eq	version:	3.1.38	Trust: 0.6
vendor:	schneider electric	model:	iiot monitor	scope:	eq	version:	0	Trust: 0.3

sources: ZDI: ZDI-19-032 // ZDI: ZDI-19-022 // ZDI: ZDI-19-030 // ZDI: ZDI-19-021 // ZDI: ZDI-19-029 // CNVD: CNVD-2019-03464 // BID: 106484 // JVNDB: JVNDB-2018-014342 // NVD: CVE-2018-7836

CVSS

SEVERITY

CVSSV2

CVSSV3

ZDI:	CVE-2018-7836
value:	HIGH
Trust: 2.1
ZDI:	CVE-2018-7836
value:	CRITICAL
Trust: 1.4
nvd@nist.gov:	CVE-2018-7836
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2018-7836
value:	CRITICAL
Trust: 0.8
CNVD:	CNVD-2019-03464
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201812-1096
value:	HIGH
Trust: 0.6
VULMON:	CVE-2018-7836
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2018-7836
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
CNVD:	CNVD-2019-03464
severity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

ZDI:	CVE-2018-7836
baseSeverity:	HIGH
baseScore:	7.2
vectorString:	AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	HIGH
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.2
impactScore:	5.9
version:	3.0
Trust: 2.1
nvd@nist.gov:	CVE-2018-7836
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.0
Trust: 1.8
ZDI:	CVE-2018-7836
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.0
Trust: 1.4

sources: ZDI: ZDI-19-032 // ZDI: ZDI-19-022 // ZDI: ZDI-19-030 // ZDI: ZDI-19-021 // ZDI: ZDI-19-029 // CNVD: CNVD-2019-03464 // VULMON: CVE-2018-7836 // JVNDB: JVNDB-2018-014342 // CNNVD: CNNVD-201812-1096 // NVD: CVE-2018-7836

PROBLEMTYPE DATA

problemtype:

CWE-434

Trust: 1.8

sources: JVNDB: JVNDB-2018-014342 // NVD: CVE-2018-7836

THREAT TYPE

network

Trust: 0.3

sources: BID: 106484

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201812-1096

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-014342

PATCH

title:	Schneider Electric has issued an update to correct this vulnerability.	url:	https://ics-cert.us-cert.gov/advisories/ICSA-19-008-02	Trust: 3.5
title:	SEVD-2018-354-03	url:	https://www.schneider-electric.com/en/download/document/SEVD-2018-354-03/	Trust: 0.8
title:	Patch for IIoTMonitor Hazardous Type File Upload Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/152471	Trust: 0.6
title:	Schneider Electric IIoT Monitor Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=88169	Trust: 0.6
title:	Check Point Security Alerts: Schneider Electric IIoT Monitor Unrestricted File Upload (CVE-2018-7836)	url:	https://vulmon.com/vendoradvisory?qidtp=check_point_security_alerts&qid=495244a44e00a37fadd60897391c108e	Trust: 0.1

EXTERNAL IDS

db:	NVD	id:	CVE-2018-7836	Trust: 6.9
db:	BID	id:	106484	Trust: 2.0
db:	SCHNEIDER	id:	SEVD-2018-354-03	Trust: 1.7
db:	ICS CERT	id:	ICSA-19-008-02	Trust: 1.2
db:	JVNDB	id:	JVNDB-2018-014342	Trust: 0.8
db:	ZDI_CAN	id:	ZDI-CAN-7120	Trust: 0.7
db:	ZDI	id:	ZDI-19-032	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-7122	Trust: 0.7
db:	ZDI	id:	ZDI-19-022	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-7136	Trust: 0.7
db:	ZDI	id:	ZDI-19-030	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-7121	Trust: 0.7
db:	ZDI	id:	ZDI-19-021	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-7135	Trust: 0.7
db:	ZDI	id:	ZDI-19-029	Trust: 0.7
db:	CNVD	id:	CNVD-2019-03464	Trust: 0.6
db:	CNNVD	id:	CNNVD-201812-1096	Trust: 0.6
db:	VULMON	id:	CVE-2018-7836	Trust: 0.1

sources: ZDI: ZDI-19-032 // ZDI: ZDI-19-022 // ZDI: ZDI-19-030 // ZDI: ZDI-19-021 // ZDI: ZDI-19-029 // CNVD: CNVD-2019-03464 // VULMON: CVE-2018-7836 // BID: 106484 // JVNDB: JVNDB-2018-014342 // CNNVD: CNNVD-201812-1096 // NVD: CVE-2018-7836

REFERENCES

url:	https://ics-cert.us-cert.gov/advisories/icsa-19-008-02	Trust: 4.7
url:	https://www.schneider-electric.com/en/download/document/sevd-2018-354-03/	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2018-7836	Trust: 1.4
url:	http://www.securityfocus.com/bid/106484	Trust: 1.1
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-7836	Trust: 0.8
url:	www.controlmicrosystems.com	Trust: 0.3
url:	https://cwe.mitre.org/data/definitions/434.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1
url:	https://advisories.checkpoint.com/defense/advisories/public/2024/cpai-2018-2576.html	Trust: 0.1

sources: ZDI: ZDI-19-032 // ZDI: ZDI-19-022 // ZDI: ZDI-19-030 // ZDI: ZDI-19-021 // ZDI: ZDI-19-029 // CNVD: CNVD-2019-03464 // VULMON: CVE-2018-7836 // BID: 106484 // JVNDB: JVNDB-2018-014342 // CNNVD: CNNVD-201812-1096 // NVD: CVE-2018-7836

CREDITS

rgod of 9sg Security Team - rgod@9sgsec.com

Trust: 3.5

sources: ZDI: ZDI-19-032 // ZDI: ZDI-19-022 // ZDI: ZDI-19-030 // ZDI: ZDI-19-021 // ZDI: ZDI-19-029

SOURCES

db:	ZDI	id:	ZDI-19-032
db:	ZDI	id:	ZDI-19-022
db:	ZDI	id:	ZDI-19-030
db:	ZDI	id:	ZDI-19-021
db:	ZDI	id:	ZDI-19-029
db:	CNVD	id:	CNVD-2019-03464
db:	VULMON	id:	CVE-2018-7836
db:	BID	id:	106484
db:	JVNDB	id:	JVNDB-2018-014342
db:	CNNVD	id:	CNNVD-201812-1096
db:	NVD	id:	CVE-2018-7836

LAST UPDATE DATE

2024-11-23T22:17:10.684000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-19-032	date:	2019-01-16T00:00:00
db:	ZDI	id:	ZDI-19-022	date:	2019-01-14T00:00:00
db:	ZDI	id:	ZDI-19-030	date:	2019-01-14T00:00:00
db:	ZDI	id:	ZDI-19-021	date:	2019-01-14T00:00:00
db:	ZDI	id:	ZDI-19-029	date:	2019-01-14T00:00:00
db:	CNVD	id:	CNVD-2019-03464	date:	2019-01-31T00:00:00
db:	VULMON	id:	CVE-2018-7836	date:	2019-02-06T00:00:00
db:	BID	id:	106484	date:	2019-01-08T00:00:00
db:	JVNDB	id:	JVNDB-2018-014342	date:	2019-03-25T00:00:00
db:	CNNVD	id:	CNNVD-201812-1096	date:	2019-02-13T00:00:00
db:	NVD	id:	CVE-2018-7836	date:	2024-11-21T04:12:51.023

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-19-032	date:	2019-01-16T00:00:00
db:	ZDI	id:	ZDI-19-022	date:	2019-01-14T00:00:00
db:	ZDI	id:	ZDI-19-030	date:	2019-01-14T00:00:00
db:	ZDI	id:	ZDI-19-021	date:	2019-01-14T00:00:00
db:	ZDI	id:	ZDI-19-029	date:	2019-01-14T00:00:00
db:	CNVD	id:	CNVD-2019-03464	date:	2019-01-31T00:00:00
db:	VULMON	id:	CVE-2018-7836	date:	2018-12-24T00:00:00
db:	BID	id:	106484	date:	2019-01-08T00:00:00
db:	JVNDB	id:	JVNDB-2018-014342	date:	2019-03-18T00:00:00
db:	CNNVD	id:	CNNVD-201812-1096	date:	2018-12-25T00:00:00
db:	NVD	id:	CVE-2018-7836	date:	2018-12-24T16:29:00.937