« Volver al listado

CVE-2018-19792

Estado: ModificadaMedia (6.7)—

The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 allows local users to cause a denial of service (buffer overflow) or possibly have unspecified other impact by creating a symlink through which the openlitespeed program can be invoked with a long command name (involving ../ characters), which is mishandled in the LshttpdMain::getServerRootFromExecutablePath function.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Litespeedtech — Openlitespeed

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-19792",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.6,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.7,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-12-03T06:29:00.460",
  "references": [
    {
      "url": "https://github.com/litespeedtech/openlitespeed/issues/117",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/litespeedtech/openlitespeed/issues/117",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 allows local users to cause a denial of service (buffer overflow) or possibly have unspecified other impact by creating a symlink through which the openlitespeed program can be invoked with a long command name (involving ../ characters), which is mishandled in the LshttpdMain::getServerRootFromExecutablePath function."
    },
    {
      "lang": "es",
      "value": "El servidor en LiteSpeed OpenLiteSpeed en versiones anteriores a la 1.5.0 RC6 permite que los usuarios locales provoquen una denegación de servicio (desbordamiento de búfer) o, posiblemente, otro impacto creando un enlace simbólico mediante el cual el programa openlitespeed puede ser invocado con un nombre de comando largo (incluyendo caracteres ../) que se manipula incorrectamente en la función LshttpdMain::getServerRootFromExecutablePath."
    }
  ],
  "lastModified": "2026-06-17T01:49:53.577",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:litespeedtech:openlitespeed:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C3B2AF25-26DB-4652-AD26-0C64D2F224FF",
              "versionEndIncluding": "1.4.41"
            },
            {
              "criteria": "cpe:2.3:a:litespeedtech:openlitespeed:1.5.0:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4F83049D-873B-4597-95AB-A2EB527D3038"
            },
            {
              "criteria": "cpe:2.3:a:litespeedtech:openlitespeed:1.5.0:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "91824E53-FCC7-4DCD-A4EE-FA9A08415842"
            },
            {
              "criteria": "cpe:2.3:a:litespeedtech:openlitespeed:1.5.0:rc3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AB251670-E1F5-43F7-9932-3EC7515CEF33"
            },
            {
              "criteria": "cpe:2.3:a:litespeedtech:openlitespeed:1.5.0:rc4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EB7D62CF-192B-479E-AADB-48B4705EA092"
            },
            {
              "criteria": "cpe:2.3:a:litespeedtech:openlitespeed:1.5.0:rc5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "69DA7BFE-EB1A-42D1-AC45-A39045BB5A60"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}