CVE-2018-15138

HIGHNuclei

ericssonlg ipecs_nms Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Title source: VulnCheck
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2018-15138 has a selected CVSS score of 7.5 (high); EIP currently links 1 catalogued exploit and 1 Nuclei template.

Description

Ericsson-LG iPECS NMS 30M allows directory traversal via ipecs-cm/download?filename=../ URIs.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Nov 26, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Catalogued exploits
1
Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

ipecs_nms

Browse ericssonlg / ipecs_nms
VulnCheckVersion data not supplied

Proofs of concept

1

Catalogued exploits

ExploitDBLG-Ericsson iPECS NMS 30M - Directory TraversalExploitDB exploitby Safak AslanNot analyzed1 file
ExploitDB
PoC details

Nuclei templates

1
ProjectDiscoveryHIGHLG-Ericsson iPECS NMS 30M - Local File InclusionCVSS 7.5

Ericsson-LG iPECS NMS 30M allows local file inclusion via ipecs-cm/download?filename=../ URIs.

Impact

Successful exploitation of this vulnerability could allow an attacker to read sensitive files on the target system, potentially leading to unauthorized access or information disclosure.

Remediation

Apply the latest security patches or updates provided by the vendor to mitigate this vulnerability.

WeaknessesCWE-22
Authors0x_Akoko
Template tagscve2018cveericssonlfitraversaledbericssonlgvkevvuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:ericssonlg:ipecs_nms:30m-2.3gn:*:*:*:*:*:*:*
https://cxsecurity.com/issue/WLB-2018080070 https://www.exploit-db.com/exploits/45167/ https://nvd.nist.gov/vuln/detail/CVE-2018-15138 https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2