CVE-2018-25113
Last modified
CVE-2018-25113 is a high-severity vulnerability rated 8.7/10 on the CVSS scale. An unauthenticated path traversal vulnerability exists in Dicoogle PACS Web Server version 2.5.0 and possibly earlier. The vulnerability allows remote attackers to read arbitrary files on the underlying system by sending a crafted request to the /exportFile endpoint using the UID parameter. EPSS estimates a 1.21% chance of exploitation in the next 30 days.
Description
An unauthenticated path traversal vulnerability exists in Dicoogle PACS Web Server version 2.5.0 and possibly earlier. The vulnerability allows remote attackers to read arbitrary files on the underlying system by sending a crafted request to the /exportFile endpoint using the UID parameter. Successful exploitation can reveal sensitive files accessible by the web server user.
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2018-25113?
How severe is CVE-2018-25113?
How do I fix CVE-2018-25113?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-25107The Crypt::Random::Source package before 0.13 for Perl has a…7.5
- CVE-2018-25108An unauthenticated remote attacker can cause a DoS in the co…7.5
- CVE-2018-25109A vulnerability has been found in Nintendo Animal Crossing, …6.4
- CVE-2018-25110Marked prior to version 0.3.17 is vulnerable to a Regular Ex…7.5
- CVE-2018-25111django-helpdesk before 1.0.0 allows Sensitive Data Exposure …4.4
- CVE-2018-25112An unauthenticated remote attacker may use an uncontrolled r…7.5
- CVE-2018-25114A remote code execution vulnerability exists within osCommer…9.3
- CVE-2018-25115Multiple D-Link DIR-series routers, including DIR-110, DIR-4…9.8
- CVE-2018-25116MyBB Thread Redirect Plugin 0.2.1 contains a cross-site scri…6.1
- CVE-2018-25117VestaCP commit a3f0fa1 (2018-05-31) up to commit ee03eff (20…9.3
- CVE-2018-25118GeoVision embedded IP devices, confirmed on GV-BX1500 and GV…10
- CVE-2018-25119Nagios Fusion versions prior to 4.1.5 are vulnerable to cros…6.1
Are you affected by CVE-2018-25113?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST