CVE-2018-14707

high · 7.5

Directory traversal in the Drobo Pix web application on Drobo 5N2 NAS version 4.0.5-13.28.96115 allows unauthenticated attackers to upload files to arbitrary locations.

7.5

CVSS

27.8%

EPSS (exploit prob.)

98th

EPSS percentile

2018-12-03

Published

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses

CWE-22

Affected products

Vendor	Product	Affected versions
drobo	5n2_firmware	4.0.5-13.28.96115
drobo	5n2	all versions

Check a specific version with /api/v1/cve/match.

References

https://blog.securityevaluators.com/call-me-a-doctor-new-vulnerabilities-in-drobo5n2-4f1d885df7fc
https://blog.securityevaluators.com/call-me-a-doctor-new-vulnerabilities-in-drobo5n2-4f1d885df7fc

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2018-14707