CVE-2018-10207

Share

CVE-2018-10207

by adidionxlm

Abstract Advisory Information

Security issue affecting the product Vaultize.
An attacker can exploit Missing Authorization on the FlexPaperViewer SWF reader, and export files that should have been restricted, via vectors involving page-by-page access to a document in SWF format.

Version affected

Vaultize Enterprise File Sharing
Versions 17.05.31

Authors: Julien EHRHART and Anthony MAIA

Common Vulnerability Scoring System

6.1
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:U/RC:C/CR:H/MC:H

Patches

Unknown

Vulnerability Disclosure Timeline

  • 24/10/17 Vaultize notification of issues
  • 27/10/17 Notification of Vaultize, issues acknowledgment
  • 08/11/17 Vaultize Notification for 9 issues
  • 09/11/17 Received Fix for:
    – Anonymous reflected XSS on error page
    – Stored XSS on file request.
    – Improper authorization leading to a creation of folders of another account
    – Missing data input validation
  • 23/11/17 Received Fix for:
    – Improper authorization when listing the history of another user
  • 07/12/17 Request for remaining fixes, no answer to Csirt
  • 02/01/18 Vulnerable Clients & Csirt notification
  • 18/04/18 Mitre notification
Top