Acme mini_httpd up to 1.29 information disclosure

Summaryinfo

A vulnerability, which was classified as critical, has been found in Acme mini_httpd up to 1.29. Affected by this vulnerability is an unknown functionality. The manipulation leads to information disclosure. This vulnerability is documented as CVE-2018-18778. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Acme mini_httpd up to 1.29 (Web Server). It has been rated as critical. This issue affects an unknown functionality. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

ACME mini_httpd before 1.30 lets remote users read arbitrary files.

The bug was discovered 10/28/2018. The weakness was released 10/28/2018 (Website). It is possible to read the advisory at acme.com. The identification of this vulnerability is CVE-2018-18778 since 10/28/2018. The exploitation is known to be easy. The attack may be initiated remotely. The successful exploitation needs a simple authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 1.30 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Web Server

Vendor

• Acme

Name

• mini_httpd

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26
• 1.27
• 1.28
• 1.29

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion