CVE Feed

    Dashboard / CVE / CVE-2018-13355

    CVE-2018-13355

    Incorrect access controls in ajaxdata.php in TerraMaster TOS version 3.1.03 allow attackers to create user groups without proper authorization.

    Published:Nov 27, 2018
    Last Modified:Nov 21, 2024
    EPS:Nov 27, 2018
    EPSS Score:0.00146
    CVSS Score:6.5

    Affected Products

    Vendor
    Terra-master
    Product
    Terramaster Operating System

    Exploits

    https://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86ahttps://blog.securityevaluators.com/vulnerabilities-in-terramaster-tos-3-1-03-fb99cf88b86a

    Related CVEs

    CVE-2022-24989 (CVSS 9.8) — TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype …
    CVE-2022-24990 (CVSS 7.5) — TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending …
    CVE-2020-35665 (CVSS 9.8) — An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metachar…
    CVE-2018-13357 (CVSS 5.4) — Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript…
    CVE-2018-13356 (CVSS 8.8) — Incorrect access control on ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to elevate user pe…
    CVE-2018-13338 (CVSS 9.8) — System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system …
    CVE-2018-13336 (CVSS 9.8) — System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system …
    CVE-2018-13351 (CVSS 4.8) — Cross-site scripting in Control Panel in TerraMaster TOS version 3.1.03 allows attackers to execute JavaScript…
    CVE-2018-13353 (CVSS 8.8) — System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute command…
    CVE-2018-13354 (CVSS 9.8) — System command injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute system …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High