Latest WinRAR, Drupal flaws under active exploitation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-20250 | Absolute Path Traversal in RARLAB WinRAR ACE Extraction (UNACEV2.dll) | 7.8 | 96% | KEVRansomwarePoC ×5 | KEV |
| CVE-2019-6340 | Deserialization RCE in Drupal 8 Core Web Services (CVE-2019-6340) | 8.1 | 92% | KEVPoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 138.204.171.108 | R if UAC is turned off. https://t.co/bK0ngP2nIy IOC: hxxp://138.204.171.108/BxjL5iKld8.zip 138.204.171.108:443 pic.twitter.com/WpJVDaGq |
| url | http://138.204.171.108/BxjL5iKld8.zip | y WinRAR if UAC is turned off. https://t.co/bK0ngP2nIy IOC: hxxp://138.204.171.108/BxjL5iKld8.zip 138.204.171.108:443 pic.twitter.com/WpJVDaGq3D — 360 Threat |
From the original article
2 min read at helpnetsecurity.com
CVE-2018-20250 , a WinRAR vulnerability that allows attackers to extract a malicious executable to one of the Windows Startup folder to be executed every time the system is booted, and CVE-2019-6340 , the remote execution flaw affecting the popular Drupal CMS, have been spotted being exploited by attackers.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.