PT-2020-13638 · Digdash Enterprise · Digdash

Florian Nivette · Published 2020-06-15 · Updated 2021-07-21 · CVE-2020-13651

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DigDash versions 2018R2 before p20200528 DigDash versions 2019R1 before p20200421 DigDash versions 2019R2 before p20200430

Description An issue allows a user to provide data that will be used to generate the JNLP file used by a client to obtain the right Java application. By providing an attacker-controlled URL, the client will obtain a rogue JNLP file specifying the installation of malicious JAR archives and executed with full privileges on the client computer.

Recommendations For DigDash version 2018R2 before p20200528, update to a version after p20200528 to resolve the issue. For DigDash version 2019R1 before p20200421, update to a version after p20200421 to resolve the issue. For DigDash version 2019R2 before p20200430, update to a version after p20200430 to resolve the issue. As a temporary workaround, consider restricting access to the JNLP file generation feature until a patch is available.

Fix

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2020-13651

Affected Products

Digdash

References · 4

• https://osv.dev/vulnerability/CVE-2020-13651 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13651 · Security Note
• https://know.bishopfox.com/advisories/digdash-version-2018 · Note
• https://t.me/cvenotify/4386 · Telegram Post