CVE-2018-19666: Path Traversal
Published Nov 29, 2018
·Updated
The agent in OSSEC through 3.1.0 on Windows allows local users to gain NT AUTHORITY\SYSTEM access via Directory Traversal by leveraging full access to the associated OSSEC server.
Affected Software
3 affected components
OSSEC OSSEC<=3.1.0
Microsoft Windows
Wazuh Wazuh>=1.0.0<=2.1.1
Event History
Nov 29, 2018
CVE Published
via MITRE·07:00 AM
Data Sourced
via MITRE·07:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-19666?
CVE-2018-19666 is rated as a critical vulnerability due to the potential for local users to gain NT AUTHORITY\SYSTEM access.
2
How do I fix CVE-2018-19666?
To mitigate CVE-2018-19666, you should upgrade OSSEC to version 3.2.0 or later.
3
Who is affected by CVE-2018-19666?
CVE-2018-19666 affects local users on Windows systems running OSSEC versions up to and including 3.1.0.
4
What kind of attack can exploit CVE-2018-19666?
CVE-2018-19666 can be exploited through a directory traversal attack to gain elevated system privileges.
5
Does CVE-2018-19666 affect Wazuh?
Yes, CVE-2018-19666 affects versions of the Wazuh agent from 1.0.0 to 2.1.1.