PT-2020-12712 · Cipplanner · Cipplanner Cipace

Published 2020-04-06 · Updated 2020-04-07 · CVE-2020-11596

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CIPPlanner CIPAce version 9.1 Build 2019092801

Description A Directory Traversal issue allows an unauthenticated attacker to make HTTP GET requests to a certain URL and obtain information about files and directories on the server.

Recommendations For CIPPlanner CIPAce version 9.1 Build 2019092801, consider restricting access to the vulnerable URL to minimize the risk of exploitation. As a temporary workaround, avoid using the affected URL until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-11596

Affected Products

Cipplanner Cipace

References · 4

• 🔥 https://criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-platform · Exploit
• https://osv.dev/vulnerability/CVE-2020-11596 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-11596 · Security Note
• https://t.me/cvenotify/2454 · Telegram Post