PT-2020-13133 · FFmpeg+1 · Ffmpeg+1

Published 2020-04-29 · Updated 2021-07-21 · CVE-2020-12473

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MonoX versions 5.1.40.5152 and earlier

Description The issue allows admins to execute arbitrary programs by reconfiguring the Converter Executable setting from ffmpeg.exe to a different program. This can be done by changing the Converter Executable setting, potentially allowing for the execution of malicious programs.

Recommendations For MonoX versions 5.1.40.5152 and earlier, consider restricting access to the Converter Executable setting to prevent reconfiguration to a malicious program. As a temporary workaround, monitor and limit the execution of programs that can be configured through this setting.

Exploit

Fix

Related Identifiers

CVE-2020-12473

Affected Products

Monox

Ffmpeg

References · 4

• 🔥 https://github.com/belong2yourself/vulnerabilities/tree/master/MonoX%20CMS/Privilege%20Escalation%20via%20ConvertVideo · Exploit
• https://osv.dev/vulnerability/CVE-2020-12473 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12473 · Security Note
• https://t.me/cvenotify/3423 · Telegram Post