« Volver al listado

CVE-2018-5204

Estado: ModificadaCrítica (9.8)—

ML Report, desde la versión 2.00.000.0000 hasta la 2.18.628.5980, contiene una vulnerabilidad que podría permitir que un atacante remoto descargue y ejecute de forma remota archivos arbitrarios configurando los argumentos en el método activex. Esto puede aprovecharse para ejecutar código.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Infraware-global — ML Report

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-5204",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "vuln@krcert.or.kr",
      "affectedData": [
        {
          "vendor": "Infraware",
          "product": "ML Report",
          "versions": [
            {
              "status": "affected",
              "version": "ML Report Between 2.00.000.0000 ~ 2.18.628.5980"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-12-28T16:29:06.033",
  "references": [
    {
      "url": "https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=30123",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "vuln@krcert.or.kr"
    },
    {
      "url": "https://www.boho.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=30123",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ML Report version Between 2.00.000.0000 and 2.18.628.5980 contains a vulnerability that could allow remote attacker to download and execute remote arbitrary file by setting the arguments to the activex method. this can be leveraged for code execution."
    },
    {
      "lang": "es",
      "value": "ML Report, desde la versión 2.00.000.0000 hasta la 2.18.628.5980, contiene una vulnerabilidad que podría permitir que un atacante remoto descargue y ejecute de forma remota archivos arbitrarios configurando los argumentos en el método activex. Esto puede aprovecharse para ejecutar código."
    }
  ],
  "lastModified": "2026-06-17T01:59:50.270",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:infraware-global:ml_report:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8A3919A2-CD48-463F-B344-2A431F47641A",
              "versionEndIncluding": "2.18.628.5980",
              "versionStartIncluding": "2.00.000.0000"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "vuln@krcert.or.kr"
}