CVE-2018-17984: High severity ispconfig vulnerability
An unanchored /[a-z]{2}/ regular expression in ISPConfig before 3.1.13 makes it possible to include arbitrary files, leading to code execution. This is exploitable by authenticated users who have local filesystem access.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-17984?
CVE-2018-17984 is a vulnerability in ISPConfig before version 3.1.13 that allows authenticated users with local filesystem access to include arbitrary files and execute code.
How severe is CVE-2018-17984?
CVE-2018-17984 has a severity rating of 7.8 (High).
How can CVE-2018-17984 be exploited?
CVE-2018-17984 can be exploited by authenticated users with local filesystem access who can use an unanchored regular expression to include arbitrary files and execute code.
What is the affected software for CVE-2018-17984?
The affected software for CVE-2018-17984 is ISPConfig with versions up to but excluding 3.1.13.
How can I fix CVE-2018-17984?
To fix CVE-2018-17984, you need to update ISPConfig to version 3.1.13 or later.