Lucene search

VulDBCVE-2018-25040

HistoryJun 17, 2022 - 1:15 p.m.

CVE-2018-25040

2022-06-1713:15:11

CWE-269

VulDB

web.nvd.nist.gov

utorrent web

vulnerability

critical

privilege escalation

http rpc server

remote attack

exploit disclosure

upgrade recommended

nvd

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.003

Percentile

70.1%

JSON

A vulnerability was found in uTorrent Web. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component HTTP RPC Server. The manipulation leads to privilege escalation. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component.

Affected configurations

Nvd

Node

utorrentwebMatch-

VendorProductVersionCPE
utorrentweb-cpe:2.3:a:utorrent:web:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
utorrent	web	-	cpe:2.3:a:utorrent:web:-:::::::*

CNA Affected

[
  {
    "product": "Web",
    "vendor": "uTorrent",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

bugs.chromium.org/p/project-zero/issues/detail?id=1524

vuldb.com/?id.113803

www.scmagazineuk.com/utorrent-apps-vulnerable-to-remote-code-execution-information-disclosure/article/746248/

Social References

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

8.7

Confidence

High

EPSS

0.003

Percentile

70.1%

JSON

Related for CVE-2018-25040