PT-2020-12541 · Ipear · Ipear

Yabobjonez · Published 2020-07-14 · Updated 2021-11-04 · CVE-2020-11084

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions iPear (affected versions not specified)

Description The manual execution of the eval() function in iPear can lead to command injection, allowing the execution of any PHP code within iPear. This may result in data change, damage, or theft from the PC. Only PCs where commands are manually executed via "For Developers" are affected.

Recommendations For iPear, consider disabling the manual execution of the eval() function via "For Developers" to minimize the risk of command injection until a patch is available. Restrict access to the "For Developers" feature to prevent unauthorized execution of PHP code. Avoid using the eval() function in iPear until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2020-11084

GHSA-4XVP-35FX-HJJJ

Affected Products

Ipear

References · 4

• https://osv.dev/vulnerability/CVE-2020-11084 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11084 · Security Note
• https://github.com/yaBobJonez/iPear/security/advisories/GHSA-4xvp-35fx-hjjj · Note
• https://t.me/cvenotify/22988 · Telegram Post