CVE-2018-12031: Path Traversal

Published Jun 7, 2018

Updated

Local file inclusion in Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via server/nodeupgradesrv.js directory traversal with the firmware parameter in a downloadFirmware action.

Affected Software

1 affected component

Eaton Intelligent Power Manager=1.6

Event History

Jun 7, 2018

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-12031?

The severity of CVE-2018-12031 is critical.

What is the affected software of CVE-2018-12031?

The affected software of CVE-2018-12031 is Eaton Intelligent Power Manager version 1.6.

How can an attacker exploit CVE-2018-12031?

An attacker can exploit CVE-2018-12031 by including a file via server/node_upgrade_srv.js directory traversal with the firmware parameter in a downloadFirmware action.

Is there a fix available for CVE-2018-12031?

Yes, a fix for CVE-2018-12031 is available.

Where can I find more information about CVE-2018-12031?

You can find more information about CVE-2018-12031 at the following link: [https://github.com/EmreOvunc/Eaton-Intelligent-Power-Manager-Local-File-Inclusion](https://github.com/EmreOvunc/Eaton-Intelligent-Power-Manager-Local-File-Inclusion)