High severity · published Jun 4, 2018
CVE-2018-10615
Directory traversal may lead to files being exfiltrated or deleted on the GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior host platform
8.1
CVSS
2.5%
EPSS
No
On KEV
Description
Directory traversal may lead to files being exfiltrated or deleted on the GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior host platform.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.5% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MP
Mds Pulsenet · GE
through 3.2.1; through 3.2.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-10615
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-10615
Permissions Required
http://www.gegridsolutions.com/app/DownloadFile.aspx?prod=pulsenet&type=9&file=1
Third Party Advisory
http://www.securityfocus.com/bid/104377
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-18-151-02
More from Mds Pulsenet
9.8
CVE-2018-10611
Java remote method invocation (RMI) input port in GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior may be exploited to allow unauthenticated users to launch…
7.5
CVE-2018-10613
Multiple variants of XML External Entity (XXE) attacks may be used to exfiltrate data from the host Windows platform in GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1…
–
CVE-2015-6459
Absolute path traversal vulnerability in the download feature in FileDownloadServlet in GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 allows remote…
–
CVE-2015-6456
GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 have hardcoded credentials for a support account, which allows remote attackers to obtain administrative…