CVE-2018-17934 is a critical path traversal vulnerability affecting all versions 3.3 and prior of NUUO CMS, allowing attackers to construct pathnames outside intended directories. With a CVSS score of 9.8, this vulnerability is easily exploitable over the network without authentication, enabling attackers to impersonate users, access restricted information, or execute arbitrary code. While not currently on the CISA KEV catalog, a Metasploit module exists for authenticated arbitrary file download, indicating readily available exploit code. Despite its high severity and exploit availability, there is minimal community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 3.3CPE matchmatch criteria | cpe:2.3:a:nuuo:nuuo_cms:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.