« Volver al listado

CVE-2018-10143

Estado: ModificadaCrítica (9.8)—

The Palo Alto Networks Expedition Migration tool 1.0.107 and earlier may allow an unauthenticated attacker with remote access to run system level commands on the device hosting this service/application.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Paloaltonetworks — Expedition

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-10143",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@paloaltonetworks.com",
      "affectedData": [
        {
          "vendor": "Palo Alto Networks",
          "product": "Palo Alto Networks Expedition",
          "versions": [
            {
              "status": "affected",
              "version": "Expedition 1.0.107 and earlier"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-12-12T00:29:00.247",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/106174",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "psirt@paloaltonetworks.com"
    },
    {
      "url": "https://doddsecurity.com/234/command-injection-on-palo-alto-networks-expedition/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "psirt@paloaltonetworks.com"
    },
    {
      "url": "https://security.paloaltonetworks.com/CVE-2018-10143",
      "source": "psirt@paloaltonetworks.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/106174",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://doddsecurity.com/234/command-injection-on-palo-alto-networks-expedition/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://security.paloaltonetworks.com/CVE-2018-10143",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Palo Alto Networks Expedition Migration tool 1.0.107 and earlier may allow an unauthenticated attacker with remote access to run system level commands on the device hosting this service/application."
    },
    {
      "lang": "es",
      "value": "La versión 1.0.107 de la herramienta Palo Alto Networks Expedition Migration podría permitir a un atacante no autenticado con acceso remoto ejecutar comandos a nivel del sistema en el dispositivo que aloje este servicio/aplicación."
    }
  ],
  "lastModified": "2026-06-17T01:33:35.550",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:paloaltonetworks:expedition:1.0.107:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9DFA2F70-6F15-42C4-B86E-5C48BF5C6718"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@paloaltonetworks.com"
}