CVE-2012-1195 Unrestricted file upload vulnerability in andesk/managementsuite/core/core.anonymous/ServerSetup.asmx in the ServerSetup web service in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to....
HighCVSS 7.5
EPSS 68.6%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Unrestricted file upload vulnerability in andesk/managementsuite/core/core.anonymous/ServerSetup.asmx in the ServerSetup web service in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension via a PutUpdateFileCore command in a RunAMTCommand SOAP request, then accessing the file via a direct request to the file in the web root.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| landesk lenovo thinkmanagement console | = 9.0.3 | No fix listed |
References
- 79276 vdb-entry
- 47666 third-party-advisory vendor-advisory
- 52023 vdb-entry
- 1026693 vdb-entry
- thinkmanagement-serversetup-file-upload(73207) vdb-entry