9.8crit
CVE-2018-5347in critical feed1 exploit
Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in the uploadTelemetry and getLogs functions in views.…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
54.2%
percentile 99%
Public exploits
1
Exploit-DB
Summary
Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in the uploadTelemetry and getLogs functions in views.py because .psp URLs are handled by the fastcgi.server component and shell metacharacters are mishandled.
Exploit prediction (EPSS)
54.16% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.
Exploits and detections
- EDB-43659 Seagate Personal Cloud - Multiple Vulnerabilities · remote · 2018-01-11
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Classification
- Weakness
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
- exploit-db.com /exploits/43659/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
- blogs.securiteam.com /index.php/archives/3548 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2018-5347
- NVD: CVE-2018-5347
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.