PT-2020-13074 · Gigamon · Gigavue

Balazs Hambalko · Published 2020-04-29 · Updated 2020-05-18 · CVE-2020-12252

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gigamon GigaVUE version 5.5.01.11

Description An issue was discovered in the upload functionality, allowing an arbitrary file upload for an authenticated user. If an executable file is uploaded into the www-root directory, it could yield remote code execution via the filename parameter.

Recommendations For Gigamon GigaVUE version 5.5.01.11, consider restricting access to the upload functionality to prevent arbitrary file uploads until a patch is available. As a temporary workaround, avoid using the filename parameter in the upload functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-12252

Affected Products

Gigavue

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-12252 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12252 · Vendor Advisory
• https://t.me/cvenotify/3405 · Telegram Post
• http://packetstormsecurity.com/files/157484/Gigamon-GigaVUE-5.5.01.11-Directory-Traversal-File-Upload.html · Note
• https://seclists.org/fulldisclosure/2020/Apr/56 · Note