CVE-2018-13980

EPSS 6.9%

Vexday Risk Score

38Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 6.9%KEV nãoPoC públicaNuclei simMetasploit —Patch —

Lifecycle

13 Jul 2018Public PoC

16 Jul 2018Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated file disclosure if the plugin "filebrowser" is installed, because of assets/php/filebrowser/filebrowser.main.php?file=../ directory traversal.

Affected products

n/a · n/a

public PoCs found — 3

cve_referencepacketstormsecurity.com/files/148537/Zeta-Producer-Desktop-CMS-14.2.0-Code-Execution-File-Disclosure.htmlunverified cve_referencewww.exploit-db.com/exploits/45016/unverified exploitdbwww.exploit-db.com/exploits/45016unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/148537/Zeta-Producer-Desktop-CMS-14.2.0-Code-Execution-File-Disclosure.html https://www.exploit-db.com/exploits/45016/https://www.sec-consult.com/en/blog/advisories/remote-code-execution-local-file-disclosure-zeta-producer-desktop-cms/