2 lines
4.5 KiB
JSON
2 lines
4.5 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unknown","product":"VertiGIS FM","vendor":"VertiGIS","versions":[{"lessThan":"10.11.363","status":"affected","version":"0","versionType":"semver"}]}],"source":"vulnerability@ncsc.ch"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:vertigis:fm:10.11.363:*:*:*:*:*:*:*","matchCriteriaId":"73FCA741-5F96-4AC3-986B-CB6DA8489664","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"A local file inclusion vulnerability in the upload/download flow of the VertiGIS FM application allows authenticated attackers to read arbitrary files from the server by manipulating a file's path during its upload. When the file is subsequently downloaded, the file in the attacker controlled path is returned. Due to the application's ASP.NET architecture, this could potentially lead to remote code execution when the \"web.config\" file is obtained. Furthermore, the application resolves UNC paths which may enable NTLM-relaying attacks.\n\n\n\n\n\n\n\nThis issue affects VertiGIS FM: 10.5.00119 (0d29d428)."},{"lang":"es","value":"Una vulnerabilidad de inclusión local de ficheros en el flujo de carga/descarga de la aplicación VertiGIS FM permite a atacantes autenticados leer ficheros arbitrarios del servidor manipulando la ruta de un fichero durante su carga. Cuando el fichero es descargado posteriormente, el fichero en la ruta controlada por el atacante es devuelto. Debido a la arquitectura ASP.NET de la aplicación, esto podría conducir potencialmente a la ejecución remota de código cuando se obtiene el fichero ’.[]’. Además, la aplicación resuelve rutas UNC lo que puede permitir ataques de retransmisión NTLM.\n\nEste problema afecta a VertiGIS FM: 10.5.00119 (0d29d428)."}],"id":"CVE-2026-0522","lastModified":"2026-11-11T19:10:00.360","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"nvd@nist.gov","type":"Primary"}],"cvssMetricV40":[{"cvssData":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"NONE","attackVector":"NETWORK","availabilityRequirement":"NOT_DEFINED","baseScore":7.4,"baseSeverity":"HIGH","confidentialityRequirement":"NOT_DEFINED","exploitMaturity":"PROOF_OF_CONCEPT","integrityRequirement":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","privilegesRequired":"LOW","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"LOW","subIntegrityImpact":"LOW","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"source":"vulnerability@ncsc.ch","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-0522","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2026-04-01T13:41:03.252558Z","version":"2.0.3"}}]},"published":"2026-04-01T14:16:26.397","references":[{"source":"vulnerability@ncsc.ch","tags":["Vendor Advisory"],"url":"https://support.vertigis.com/hc/en-us/articles/31214433137042-Security-Vulnerability-VertiGIS-FM"},{"source":"vulnerability@ncsc.ch","tags":["Exploit","Third Party Advisory"],"url":"https://www.redguard.ch/blog/2026/04/01/advisory-vertigis-vertigisfm/"}],"sourceIdentifier":"vulnerability@ncsc.ch","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-610"}],"source":"vulnerability@ncsc.ch","type":"Secondary"}]}
|