CVE-2018-16660

EPSS 18.6%

Vexday Risk Score

23Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 18.6%KEV nãoPoC —Nuclei —Metasploit simPatch —

Lifecycle

08 Oct 2018Metasploit module available

25 Apr 2019Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

A command injection vulnerability in PWS in Imperva SecureSphere 13.0.0.10 and 13.1.0.10 Gateway allows an attacker with authenticated access to execute arbitrary OS commands on a vulnerable installation.

Affected products

n/a · n/a

References

https://www.exploit-db.com/exploits/45542/https://www.imperva.com/products/securesphere/web-application-firewall/