CVE-2018-0496 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	7.5 HIGH	NETWORK	LOW	NONE	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
debian	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 69%

Vendor	Product	Version
dinknetwork	dfarc	𝑥 < 3.14
dinknetwork	dfarc2	𝑥 < 3.14
debian	debian_linux	8.0

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

freedink-dfarc

bullseye	3.14-4 fixed
bookworm	3.14-5 fixed
sid	3.14-7 fixed
trixie	3.14-7 fixed

Ubuntu Releases

Ubuntu Product

Codename

freedink-dfarc

disco	not-affected
cosmic	not-affected
bionic	Fixed 3.12-1+deb9u1build0.18.4.1 released
artful	ignored
xenial	Fixed 3.12-1+deb9u1build0.16.4.1 released
trusty	dne

Common Weakness Enumeration

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References

https://git.savannah.gnu.org/cgit/freedink/dfarc.git/commit/?id=40cc957f52e772f45125126439ba9333cf2d2998

https://lists.debian.org/debian-lts-announce/2019/02/msg00033.html

https://savannah.gnu.org/forum/forum.php?forum_id=9169

https://git.savannah.gnu.org/cgit/freedink/dfarc.git/commit/?id=40cc957f52e772f45125126439ba9333cf2d2998

https://lists.debian.org/debian-lts-announce/2019/02/msg00033.html

https://savannah.gnu.org/forum/forum.php?forum_id=9169