PT-2020-12496 · Intel · Intelmq Manager

Bernhard Herzog · Published 2020-04-30 · Updated 2020-05-06 · CVE-2020-11016

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions IntelMQ Manager versions 1.1.0 through 2.1.0

Description The issue arises from the backend's incorrect handling of user-input messages in the "send" functionality of the Inspect-tool of the Monitor component. This could allow an attacker with access to the IntelMQ Manager to execute arbitrary code with the privileges of the webserver.

Recommendations For IntelMQ Manager versions 1.1.0 through 2.1.0, update to version 2.1.1 to fix the vulnerability. As a temporary workaround, consider restricting access to the Inspect-tool of the Monitor component until the update is applied.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-11016

GHSA-RRHH-RCGP-Q2M2

Affected Products

Intelmq Manager

References · 7

• https://github.com/certtools/intelmq-manager/security/advisories/GHSA-rrhh-rcgp-q2m2 · Patch
• https://github.com/certtools/intelmq-manager/commit/b9a2ac43a4f99d764b827108f6a99dc4a9faa013 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-11016 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11016 · Vendor Advisory
• https://github.com/certtools/intelmq-manager/releases/tag/2.1.1 · Note
• https://lists.cert.at/pipermail/intelmq-users/2020-April/000161.html · Note
• https://t.me/cvenotify/3483 · Telegram Post