cvelistv5 - CVE-2018-16202

CVE-2018-16202 (GCVE-0-2018-16202)

Vulnerability from cvelistv5

Published

2019-01-09 22:00

Modified

2024-08-05 10:17

Severity ?

CWE

Directory Traversal

Summary

Directory traversal vulnerability in cordova-plugin-ionic-webview versions prior to 2.2.0 (not including 2.0.0-beta.0, 2.0.0-beta.1, 2.0.0-beta.2, and 2.1.0-0) allows remote attackers to access arbitrary files via unspecified vectors.

References

URL

	Vendor	Product	Version
	npm, Inc.	cordova-plugin-ionic-webview	Version: versions prior to 2.2.0 (not including 2.0.0-beta.0, 2.0.0-beta.1, 2.0.0-beta.2, and 2.1.0-0)

ICSA-22-025-01

Vulnerability from csaf_cisa

Published

2022-01-25 00:00

Modified

2022-01-25 00:00

Summary

GE Gas Power ToolBoxST

Notes

CISA Disclaimer

This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov

Legal Notice

All information products included in https://us-cert.cisa.gov/ics are provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.

Risk evaluation

Successful exploitation of these vulnerabilities could result in data exfiltration or arbitrary write, overwrite, and execution.

Critical infrastructure sectors

Communications, Critical Manufacturing, Energy, Healthcare and Public Health, Transportation Systems, Water and Wastewater Systems

Countries/areas deployed

Worldwide

Company headquarters location

United States

Recommended Practices

CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

Recommended Practices

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.

Recommended Practices

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Exploitability

No known public exploits specifically target these vulnerabilities.

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Sharon Briznov"
        ],
        "organization": "Claroty",
        "summary": "reporting these vulnerabilities to GE"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
        "title": "CISA Disclaimer"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "summary",
        "text": "Successful exploitation of these vulnerabilities could result in data exfiltration or arbitrary write, overwrite, and execution.",
        "title": "Risk evaluation"
      },
      {
        "category": "other",
        "text": "Communications, Critical Manufacturing, Energy, Healthcare and Public Health, Transportation Systems, Water and Wastewater Systems",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "United States",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also recommends users take the following measures to protect themselves from social engineering attacks:",
        "title": "Recommended Practices"
      },
      {
        "category": "other",
        "text": "No known public exploits specifically target these vulnerabilities.",
        "title": "Exploitability"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-22-025-01 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2022/icsa-22-025-01.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-22-025-01 Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-025-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ncas/tips/ST04-014"
      }
    ],
    "title": "GE Gas Power ToolBoxST",
    "tracking": {
      "current_release_date": "2022-01-25T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-22-025-01",
      "initial_release_date": "2022-01-25T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2022-01-25T00:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "ICSA-22-025-01 GE Gas Power ToolBoxST"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 07.09.07C",
                "product": {
                  "name": "ToolBoxST OS: All versions prior to 07.09.07C",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "ToolBoxST OS"
          }
        ],
        "category": "vendor",
        "name": "General Electric (GE)"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-44477",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity (XXE) vulnerability using the DTD parameter entities technique that could result in disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack. The vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project/template file.CVE-2021-44477 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-44477"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "GE addressed CVE-2021-44477 in ToolBoxST OS Version 07.09.07C and above by disabling the use of DTD\u0027s, which are not necessary for ToolBoxST functionality.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-44477"
        },
        {
          "category": "mitigation",
          "details": "Users should ensure they follow the password protection and network segmentation guidance laid out in GEH-6839 Secure Deployment Guide. Additionally, the use of SDI Secure Mode offers considerable protection against this attack as the threat actor must be able to perform a download to the controller over SDI. Secure Mode validates authenticity and protects against spoofing of SDI commands.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "GE Gas Power Cybersecurity and Engineering teams will continue to investigate internally as well as monitor industry-based news for any changes or updates. To reduce the risk vulnerabilities such as these may represent to the controls network, GE recommends the implementation of a good defense-in-depth strategy as detailed in GEH-6839. Some recommended controls include:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Minimize network exposure for all controllers with the use of network segmentation, placement of controllers behind controls network firewalls and ensure they are not accessible from the Internet.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Block suspicious external IP addresses at the controls network firewalls. Monitor traffic internally for unusual behavior.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Implement defense-in-depth within the controls network environment consisting of tools such as Intrusion detection/prevention systems (IDS/IPS), firewalls, and network access control (NAC).",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Implement and maintain an anti-malware solution and an endpoint detection and response (EDR) solution.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Disable remote access services and protocols such as remote desktop protocol (RDP) unless needed. Monitor and restrict remote access usage on a least-privilege basis.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Have backup and restore processes and procedures in place for disaster recovery and incident response.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Monitor and maintain account provisioning and access control based on the principle of least privilege.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "For more information, please see the GE advisory on the GE security page. Users can also contact GE Power PSIRT for specific mitigations.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.ge.com/content/dam/cyber_security/global/en_US/pdfs/2022-01-20_GE_Gas_Power_Product_Security_Advisory-Vulnerabilities_in_ToolBoxST.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2018-16202",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "ToolBoxST prior to Version 7.8.0 uses a vulnerable version of the Ionic .NET Zip library that does not properly sanitize path names allowing files to be extracted to a location above their parent directory and back to the root directory. If an attacker compromises an HMI or creates their own SDI client, they can upload the device.zip file from a controller, patch it to contain a malicious file and path, and download it back to the controller. The next user to perform an upload could grab the malicious device.zip and extract it to their HMI, creating the potential for arbitrary write, overwrite, and execution.CVE-2018-16202 has been assigned to this vulnerability. A CVSS v3 base score of 6.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-16202"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "GE upgraded the Ionic library in ToolBoxST Version 7.8.0 to resolve CVE-2018-16202",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-16202"
        },
        {
          "category": "mitigation",
          "details": "Users should ensure they follow the password protection and network segmentation guidance laid out in GEH-6839 Secure Deployment Guide. Additionally, the use of SDI Secure Mode offers considerable protection against this attack as the threat actor must be able to perform a download to the controller over SDI. Secure Mode validates authenticity and protects against spoofing of SDI commands.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "GE Gas Power Cybersecurity and Engineering teams will continue to investigate internally as well as monitor industry-based news for any changes or updates. To reduce the risk vulnerabilities such as these may represent to the controls network, GE recommends the implementation of a good defense-in-depth strategy as detailed in GEH-6839. Some recommended controls include:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Minimize network exposure for all controllers with the use of network segmentation, placement of controllers behind controls network firewalls and ensure they are not accessible from the Internet.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Block suspicious external IP addresses at the controls network firewalls. Monitor traffic internally for unusual behavior.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Implement defense-in-depth within the controls network environment consisting of tools such as Intrusion detection/prevention systems (IDS/IPS), firewalls, and network access control (NAC).",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Implement and maintain an anti-malware solution and an endpoint detection and response (EDR) solution.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Disable remote access services and protocols such as remote desktop protocol (RDP) unless needed. Monitor and restrict remote access usage on a least-privilege basis.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Have backup and restore processes and procedures in place for disaster recovery and incident response.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Monitor and maintain account provisioning and access control based on the principle of least privilege.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "For more information, please see the GE advisory on the GE security page. Users can also contact GE Power PSIRT for specific mitigations.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.ge.com/content/dam/cyber_security/global/en_US/pdfs/2022-01-20_GE_Gas_Power_Product_Security_Advisory-Vulnerabilities_in_ToolBoxST.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    }
  ]
}

icsa-22-025-01

Vulnerability from csaf_cisa

Published

2022-01-25 00:00

Modified

2022-01-25 00:00

Summary

GE Gas Power ToolBoxST

Notes

CISA Disclaimer

This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov

Legal Notice

Risk evaluation

Successful exploitation of these vulnerabilities could result in data exfiltration or arbitrary write, overwrite, and execution.

Critical infrastructure sectors

Communications, Critical Manufacturing, Energy, Healthcare and Public Health, Transportation Systems, Water and Wastewater Systems

Countries/areas deployed

Worldwide

Company headquarters location

United States

Recommended Practices

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

Exploitability

No known public exploits specifically target these vulnerabilities.

JSON

To clipboard

{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Sharon Briznov"
        ],
        "organization": "Claroty",
        "summary": "reporting these vulnerabilities to GE"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://us-cert.cisa.gov/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov",
        "title": "CISA Disclaimer"
      },
      {
        "category": "legal_disclaimer",
        "text": "All information products included in https://us-cert.cisa.gov/ics are provided \"as is\" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained within. DHS does not endorse any commercial product or service, referenced in this product or otherwise. Further dissemination of this product is governed by the Traffic Light Protocol (TLP) marking in the header. For more information about TLP, see https://us-cert.cisa.gov/tlp/.",
        "title": "Legal Notice"
      },
      {
        "category": "summary",
        "text": "Successful exploitation of these vulnerabilities could result in data exfiltration or arbitrary write, overwrite, and execution.",
        "title": "Risk evaluation"
      },
      {
        "category": "other",
        "text": "Communications, Critical Manufacturing, Energy, Healthcare and Public Health, Transportation Systems, Water and Wastewater Systems",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "United States",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\nCISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on cisa.gov in the Technical Information Paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also recommends users take the following measures to protect themselves from social engineering attacks:",
        "title": "Recommended Practices"
      },
      {
        "category": "other",
        "text": "No known public exploits specifically target these vulnerabilities.",
        "title": "Exploitability"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "Email: CISAservicedesk@cisa.dhs.gov;\n Toll Free: 1-888-282-0870",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-22-025-01 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2022/icsa-22-025-01.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-22-025-01 Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-22-025-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/uscert/ncas/tips/ST04-014"
      }
    ],
    "title": "GE Gas Power ToolBoxST",
    "tracking": {
      "current_release_date": "2022-01-25T00:00:00.000000Z",
      "generator": {
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.0.0"
        }
      },
      "id": "ICSA-22-025-01",
      "initial_release_date": "2022-01-25T00:00:00.000000Z",
      "revision_history": [
        {
          "date": "2022-01-25T00:00:00.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "ICSA-22-025-01 GE Gas Power ToolBoxST"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c 07.09.07C",
                "product": {
                  "name": "ToolBoxST OS: All versions prior to 07.09.07C",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "ToolBoxST OS"
          }
        ],
        "category": "vendor",
        "name": "General Electric (GE)"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-44477",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "notes": [
        {
          "category": "summary",
          "text": "GE Gas Power ToolBoxST Version v04.07.05C suffers from an XML external entity (XXE) vulnerability using the DTD parameter entities technique that could result in disclosure and retrieval of arbitrary data on the affected node via an out-of-band (OOB) attack. The vulnerability is triggered when input passed to the XML parser is not sanitized while parsing the XML project/template file.CVE-2021-44477 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-44477"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "GE addressed CVE-2021-44477 in ToolBoxST OS Version 07.09.07C and above by disabling the use of DTD\u0027s, which are not necessary for ToolBoxST functionality.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-44477"
        },
        {
          "category": "mitigation",
          "details": "Users should ensure they follow the password protection and network segmentation guidance laid out in GEH-6839 Secure Deployment Guide. Additionally, the use of SDI Secure Mode offers considerable protection against this attack as the threat actor must be able to perform a download to the controller over SDI. Secure Mode validates authenticity and protects against spoofing of SDI commands.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "GE Gas Power Cybersecurity and Engineering teams will continue to investigate internally as well as monitor industry-based news for any changes or updates. To reduce the risk vulnerabilities such as these may represent to the controls network, GE recommends the implementation of a good defense-in-depth strategy as detailed in GEH-6839. Some recommended controls include:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Minimize network exposure for all controllers with the use of network segmentation, placement of controllers behind controls network firewalls and ensure they are not accessible from the Internet.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Block suspicious external IP addresses at the controls network firewalls. Monitor traffic internally for unusual behavior.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Implement defense-in-depth within the controls network environment consisting of tools such as Intrusion detection/prevention systems (IDS/IPS), firewalls, and network access control (NAC).",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Implement and maintain an anti-malware solution and an endpoint detection and response (EDR) solution.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Disable remote access services and protocols such as remote desktop protocol (RDP) unless needed. Monitor and restrict remote access usage on a least-privilege basis.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Have backup and restore processes and procedures in place for disaster recovery and incident response.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Monitor and maintain account provisioning and access control based on the principle of least privilege.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "For more information, please see the GE advisory on the GE security page. Users can also contact GE Power PSIRT for specific mitigations.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.ge.com/content/dam/cyber_security/global/en_US/pdfs/2022-01-20_GE_Gas_Power_Product_Security_Advisory-Vulnerabilities_in_ToolBoxST.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    },
    {
      "cve": "CVE-2018-16202",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "notes": [
        {
          "category": "summary",
          "text": "ToolBoxST prior to Version 7.8.0 uses a vulnerable version of the Ionic .NET Zip library that does not properly sanitize path names allowing files to be extracted to a location above their parent directory and back to the root directory. If an attacker compromises an HMI or creates their own SDI client, they can upload the device.zip file from a controller, patch it to contain a malicious file and path, and download it back to the controller. The next user to perform an upload could grab the malicious device.zip and extract it to their HMI, creating the potential for arbitrary write, overwrite, and execution.CVE-2018-16202 has been assigned to this vulnerability. A CVSS v3 base score of 6.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L).",
          "title": "Vulnerability Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-0001"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "web.nvd.nist.gov",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-16202"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "GE upgraded the Ionic library in ToolBoxST Version 7.8.0 to resolve CVE-2018-16202",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-16202"
        },
        {
          "category": "mitigation",
          "details": "Users should ensure they follow the password protection and network segmentation guidance laid out in GEH-6839 Secure Deployment Guide. Additionally, the use of SDI Secure Mode offers considerable protection against this attack as the threat actor must be able to perform a download to the controller over SDI. Secure Mode validates authenticity and protects against spoofing of SDI commands.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "GE Gas Power Cybersecurity and Engineering teams will continue to investigate internally as well as monitor industry-based news for any changes or updates. To reduce the risk vulnerabilities such as these may represent to the controls network, GE recommends the implementation of a good defense-in-depth strategy as detailed in GEH-6839. Some recommended controls include:",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Minimize network exposure for all controllers with the use of network segmentation, placement of controllers behind controls network firewalls and ensure they are not accessible from the Internet.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Block suspicious external IP addresses at the controls network firewalls. Monitor traffic internally for unusual behavior.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "When remote access is required, use secure methods, such as virtual private networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as its connected devices.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Implement defense-in-depth within the controls network environment consisting of tools such as Intrusion detection/prevention systems (IDS/IPS), firewalls, and network access control (NAC).",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Implement and maintain an anti-malware solution and an endpoint detection and response (EDR) solution.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Disable remote access services and protocols such as remote desktop protocol (RDP) unless needed. Monitor and restrict remote access usage on a least-privilege basis.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Have backup and restore processes and procedures in place for disaster recovery and incident response.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "Monitor and maintain account provisioning and access control based on the principle of least privilege.",
          "product_ids": [
            "CSAFPID-0001"
          ]
        },
        {
          "category": "mitigation",
          "details": "For more information, please see the GE advisory on the GE security page. Users can also contact GE Power PSIRT for specific mitigations.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.ge.com/content/dam/cyber_security/global/en_US/pdfs/2022-01-20_GE_Gas_Power_Product_Security_Advisory-Vulnerabilities_in_ToolBoxST.pdf"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L",
            "version": "3.0"
          },
          "products": [
            "CSAFPID-0001"
          ]
        }
      ]
    }
  ]
}

gsd-2018-16202

Vulnerability from gsd

Modified

2023-12-13 01:22

Details

Aliases

CVE-2018-16202

Aliases

CVE-2018-16202

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2018-16202",
    "description": "Directory traversal vulnerability in cordova-plugin-ionic-webview versions prior to 2.2.0 (not including 2.0.0-beta.0, 2.0.0-beta.1, 2.0.0-beta.2, and 2.1.0-0) allows remote attackers to access arbitrary files via unspecified vectors.",
    "id": "GSD-2018-16202"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2018-16202"
      ],
      "details": "Directory traversal vulnerability in cordova-plugin-ionic-webview versions prior to 2.2.0 (not including 2.0.0-beta.0, 2.0.0-beta.1, 2.0.0-beta.2, and 2.1.0-0) allows remote attackers to access arbitrary files via unspecified vectors.",
      "id": "GSD-2018-16202",
      "modified": "2023-12-13T01:22:26.012832Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "vultures@jpcert.or.jp",
        "ID": "CVE-2018-16202",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "cordova-plugin-ionic-webview",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "versions prior to 2.2.0 (not including 2.0.0-beta.0, 2.0.0-beta.1, 2.0.0-beta.2, and 2.1.0-0)"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "npm, Inc."
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Directory traversal vulnerability in cordova-plugin-ionic-webview versions prior to 2.2.0 (not including 2.0.0-beta.0, 2.0.0-beta.1, 2.0.0-beta.2, and 2.1.0-0) allows remote attackers to access arbitrary files via unspecified vectors."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Directory Traversal"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "JVN#69812763",
            "refsource": "JVN",
            "url": "https://jvn.jp/en/jp/JVN69812763/index.html"
          },
          {
            "name": "https://github.com/ionic-team/cordova-plugin-ionic-webview",
            "refsource": "MISC",
            "url": "https://github.com/ionic-team/cordova-plugin-ionic-webview"
          },
          {
            "name": "https://www.npmjs.com/advisories/746",
            "refsource": "MISC",
            "url": "https://www.npmjs.com/advisories/746"
          },
          {
            "name": "JVN#60497148",
            "refsource": "JVN",
            "url": "http://jvn.jp/en/jp/JVN60497148/index.html"
          }
        ]
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c2.2.0",
          "affected_versions": "All versions before 2.2.0",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-22",
            "CWE-352",
            "CWE-937"
          ],
          "date": "2021-09-22",
          "description": "Directory traversal vulnerability in cordova-plugin-ionic-webview (not including ) allows remote attackers to access arbitrary files via unspecified vectors.",
          "fixed_versions": [
            "2.2.0"
          ],
          "identifier": "CVE-2018-16202",
          "identifiers": [
            "GHSA-xwjh-cp99-cj8q",
            "CVE-2018-16202"
          ],
          "not_impacted": "All versions starting from 2.2.0",
          "package_slug": "npm/cordova-plugin-ionic-webview",
          "pubdate": "2019-02-12",
          "solution": "Upgrade to version 2.2.0 or above.",
          "title": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2018-16202",
            "https://github.com/advisories/GHSA-xwjh-cp99-cj8q",
            "https://www.npmjs.com/advisories/746",
            "https://github.com/ionic-team/cordova-plugin-ionic-webview",
            "https://jvn.jp/en/jp/JVN69812763/index.html",
            "http://jvn.jp/en/jp/JVN60497148/index.html"
          ],
          "uuid": "a5560c8a-8586-4103-bb49-987dce01aa75"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:ionicframework:ionic_web_view:2.0.0:-:*:*:*:cordova:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ionicframework:ionic_web_view:*:*:*:*:*:cordova:*:*",
                "cpe_name": [],
                "versionEndIncluding": "1.2.1",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:ionicframework:ionic_web_view:*:*:*:*:*:cordova:*:*",
                "cpe_name": [],
                "versionEndExcluding": "2.2.0",
                "versionStartIncluding": "2.0.1",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "vultures@jpcert.or.jp",
          "ID": "CVE-2018-16202"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Directory traversal vulnerability in cordova-plugin-ionic-webview versions prior to 2.2.0 (not including 2.0.0-beta.0, 2.0.0-beta.1, 2.0.0-beta.2, and 2.1.0-0) allows remote attackers to access arbitrary files via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-22"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.npmjs.com/advisories/746",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://www.npmjs.com/advisories/746"
            },
            {
              "name": "JVN#69812763",
              "refsource": "JVN",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://jvn.jp/en/jp/JVN69812763/index.html"
            },
            {
              "name": "https://github.com/ionic-team/cordova-plugin-ionic-webview",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/ionic-team/cordova-plugin-ionic-webview"
            },
            {
              "name": "JVN#60497148",
              "refsource": "JVN",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "http://jvn.jp/en/jp/JVN60497148/index.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 4.0
        }
      },
      "lastModifiedDate": "2019-10-15T18:53Z",
      "publishedDate": "2019-01-09T23:29Z"
    }
  }
}

fkie_cve-2018-16202

Vulnerability from fkie_nvd

Published

2019-01-09 23:29

Modified

2024-11-21 03:52

Severity ?

8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Summary

References

URL	Tags
vultures@jpcert.or.jp	http://jvn.jp/en/jp/JVN60497148/index.html	Third Party Advisory
vultures@jpcert.or.jp	https://github.com/ionic-team/cordova-plugin-ionic-webview	Third Party Advisory
vultures@jpcert.or.jp	https://jvn.jp/en/jp/JVN69812763/index.html	Third Party Advisory
vultures@jpcert.or.jp	https://www.npmjs.com/advisories/746	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://jvn.jp/en/jp/JVN60497148/index.html	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/ionic-team/cordova-plugin-ionic-webview	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://jvn.jp/en/jp/JVN69812763/index.html	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://www.npmjs.com/advisories/746	Third Party Advisory

Impacted products

Vendor	Product	Version
ionicframework	ionic_web_view	*
ionicframework	ionic_web_view	*
ionicframework	ionic_web_view	2.0.0

JSON

To clipboard

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ionicframework:ionic_web_view:*:*:*:*:*:cordova:*:*",
              "matchCriteriaId": "1CD78013-1AB1-4B1D-A045-7AD5FF61A855",
              "versionEndIncluding": "1.2.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ionicframework:ionic_web_view:*:*:*:*:*:cordova:*:*",
              "matchCriteriaId": "A895B007-4B3B-4D5D-B6CC-BD2A0BBD0A4C",
              "versionEndExcluding": "2.2.0",
              "versionStartIncluding": "2.0.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ionicframework:ionic_web_view:2.0.0:-:*:*:*:cordova:*:*",
              "matchCriteriaId": "5FADF770-008F-43D4-AF2A-17433AFA1787",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Directory traversal vulnerability in cordova-plugin-ionic-webview versions prior to 2.2.0 (not including 2.0.0-beta.0, 2.0.0-beta.1, 2.0.0-beta.2, and 2.1.0-0) allows remote attackers to access arbitrary files via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de salto de directorio en cordova-plugin-ionic-webview, en versiones anteriores a la 2.2.0 (excluyendo las 2.0.0-beta.0, 2.0.0-beta.1, 2.0.0-beta.2 y 2.1.0-0), permite que atacantes remotos accedan a archivos arbitrarios mediante vectores sin especificar."
    }
  ],
  "id": "CVE-2018-16202",
  "lastModified": "2024-11-21T03:52:17.000",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.6,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-01-09T23:29:04.933",
  "references": [
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://jvn.jp/en/jp/JVN60497148/index.html"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/ionic-team/cordova-plugin-ionic-webview"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://jvn.jp/en/jp/JVN69812763/index.html"
    },
    {
      "source": "vultures@jpcert.or.jp",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.npmjs.com/advisories/746"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://jvn.jp/en/jp/JVN60497148/index.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/ionic-team/cordova-plugin-ionic-webview"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://jvn.jp/en/jp/JVN69812763/index.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.npmjs.com/advisories/746"
    }
  ],
  "sourceIdentifier": "vultures@jpcert.or.jp",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

CVE-2018-16202

Vulnerability from jvndb

Published

2018-12-21 14:17

Modified

2019-08-28 10:04

Severity ?

4.7 (Medium) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

Summary

cordova-plugin-ionic-webview vulnerable to path traversal

Details

cordova-plugin-ionic-webview provided by npm, Inc. contains a path traversal vulnerability (CWE-22) . This vulnerability was first reported to npm, Inc. by the below reporters then also reported to IPA. Based on the coordination request made by the reporters, JPCERT/CC coordinated with npm, Inc. and published this advisory on JVN. Reporters: Tatsuya Sakamto and Gaku Mochizuki of Mitsui Bussan Secure Directions, Inc.

References

Type

URL

	JVN	http://jvn.jp/en/jp/JVN69812763/index.html
	CVE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16202
	NVD	https://nvd.nist.gov/vuln/detail/CVE-2018-16202
	Path Traversal(CWE-22)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

Ionic

cordova-plugin-ionic-webview

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000133.html",
  "dc:date": "2019-08-28T10:04+09:00",
  "dcterms:issued": "2018-12-21T14:17+09:00",
  "dcterms:modified": "2019-08-28T10:04+09:00",
  "description": "cordova-plugin-ionic-webview provided by npm, Inc. contains a path traversal vulnerability (CWE-22) .\r\n\r\nThis vulnerability was first reported to npm, Inc. by the below reporters then also reported to IPA. Based on the coordination request made by the reporters, JPCERT/CC coordinated with npm, Inc. and published this advisory on JVN.\r\n\r\nReporters: Tatsuya Sakamto and Gaku Mochizuki of Mitsui Bussan Secure Directions, Inc.",
  "link": "https://jvndb.jvn.jp/en/contents/2018/JVNDB-2018-000133.html",
  "sec:cpe": {
    "#text": "cpe:/a:ionic:cordova-plugin-ionic-webview",
    "@product": "cordova-plugin-ionic-webview",
    "@vendor": "Ionic",
    "@version": "2.2"
  },
  "sec:cvss": [
    {
      "@score": "4.3",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
      "@version": "2.0"
    },
    {
      "@score": "4.7",
      "@severity": "Medium",
      "@type": "Base",
      "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N",
      "@version": "3.0"
    }
  ],
  "sec:identifier": "JVNDB-2018-000133",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN69812763/index.html",
      "@id": "JVN#69812763",
      "@source": "JVN"
    },
    {
      "#text": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16202",
      "@id": "CVE-2018-16202",
      "@source": "CVE"
    },
    {
      "#text": "https://nvd.nist.gov/vuln/detail/CVE-2018-16202",
      "@id": "CVE-2018-16202",
      "@source": "NVD"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-22",
      "@title": "Path Traversal(CWE-22)"
    }
  ],
  "title": "cordova-plugin-ionic-webview vulnerable to path traversal"
}

ghsa-xwjh-cp99-cj8q

Vulnerability from github

Published

2019-02-12 15:36

Modified

2021-09-22 18:20

Severity ?

8.6 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Summary

Path Traversal in cordova-plugin-ionic-webview

Details

Versions of cordova-plugin-ionic-webview prior to 2.2.0 are vulnerable to Path Traversal, allowing attackers access to OS local files that should be inaccessible by third-party applications. The package launches a webserver listening on http://localhost:8080 without restricting access of the app itself, thus escaping the iOS application sandbox and accessing local files.

Recommendation

Upgrade to version 2.2.0

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "cordova-plugin-ionic-webview"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.2.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2018-16202"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T22:04:44Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "Versions of `cordova-plugin-ionic-webview` prior to 2.2.0 are vulnerable to Path Traversal, allowing attackers access to OS local files that should be inaccessible by third-party applications.  The package launches a webserver listening on http://localhost:8080 without restricting access of the app itself, thus escaping the iOS application sandbox and accessing local files.\n\n\n## Recommendation\n\nUpgrade to version 2.2.0",
  "id": "GHSA-xwjh-cp99-cj8q",
  "modified": "2021-09-22T18:20:58Z",
  "published": "2019-02-12T15:36:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16202"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-xwjh-cp99-cj8q"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ionic-team/cordova-plugin-ionic-webview"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN69812763/index.html"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/746"
    },
    {
      "type": "WEB",
      "url": "http://jvn.jp/en/jp/JVN60497148/index.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Path Traversal in cordova-plugin-ionic-webview"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2018-16202 (GCVE-0-2018-16202)

Vulnerability from cvelistv5

ICSA-22-025-01

Vulnerability from csaf_cisa

icsa-22-025-01

Vulnerability from csaf_cisa

gsd-2018-16202

Vulnerability from gsd

fkie_cve-2018-16202

Vulnerability from fkie_nvd

CVE-2018-16202

Vulnerability from jvndb

ghsa-xwjh-cp99-cj8q

Vulnerability from github

Recommendation

Tags

Sightings

Nomenclature