PT-2020-10356 · Determine · Determine Contract Lifecycle Management

Esteban Rodriguez · Published 2020-01-05 · Updated 2021-07-21 · CVE-2019-20155

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Determine Contract Lifecycle Management (CLM) version 5.4

Description An issue in report edit.jsp allows any authenticated user to execute Groovy code when generating a report. This results in arbitrary code execution on the underlying server.

Recommendations For version 5.4, consider restricting access to the report edit.jsp page until a fix is available, and avoid generating reports from untrusted sources to minimize the risk of exploitation.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2019-20155

Affected Products

Determine Contract Lifecycle Management

References · 3

• 🔥 https://n00py.io/2020/01/zero-day-exploit-in-determine-selectica-contract-lifecycle-management-sclm-v5-4 · Exploit
• https://osv.dev/vulnerability/CVE-2019-20155 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20155 · Security Note