CVE-2018-10057

The remote management interface of cgminer 4.10.0 and bfgminer 5.5.0 allows an authenticated remote attacker to write the miner configuration file to arbitrary locations on the server due to missing basedir restrictions (absolute directory traversal).

CVSS v3.0

6.5 MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CVSS v2.0

4.0 MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N

EPSS

2.36% chance of exploitation in the next 30 days, 83th percentile

Published

2018-06-05

Updated

2024-08-05

Proof-of-concept exploits (1)

• tintinweb/pub/tree/master/pocs/cve-2018-10057

References

• CVE Record
• NVD entry

Related

• CVE-2017-18016
• CVE-2017-8798
• CVE-2018-10058
• CVE-2020-15690
• CVE-2018-10054
• CVE-2018-10052