PT-2020-12866 · Rukovoditel · Rukovoditel

Published 2020-04-27 · Updated 2020-05-05 · CVE-2020-11817

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rukovoditel version 2.5.2

Description The issue allows attackers to upload arbitrary files to the server by changing the content-type value, potentially leading to command execution on the server. This attack is specific to when the Maintenance Mode setting is enabled.

Recommendations For Rukovoditel version 2.5.2, consider disabling the Maintenance Mode setting until a fix is available to prevent exploitation. Additionally, restrict file upload capabilities to minimize the risk of arbitrary file uploads.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-11817

Affected Products

Rukovoditel

References · 4

• 🔥 https://fatihhcelik.blogspot.com/2020/01/rukovoditel-maintenance-mode.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-11817 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11817 · Vendor Advisory
• https://t.me/cvenotify/3240 · Telegram Post