PT-2020-13653 · Quickbox+1 · Quickbox Community Edition+2

Published 2020-06-01 · Updated 2021-07-21 · CVE-2020-13695

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions QuickBox Community Edition versions 2.5.5 and earlier QuickBox Pro Edition versions 2.1.8 and earlier

Description The issue allows an attacker to obtain sensitive information by exploiting the local www-data user's sudo privileges to execute grep as root without a password. This can be done via a grep of a /root/*.db or /etc/shadow file.

Recommendations For QuickBox Community Edition versions 2.5.5 and earlier, remove the sudo privileges for the www-data user to execute grep as root without a password. For QuickBox Pro Edition versions 2.1.8 and earlier, remove the sudo privileges for the www-data user to execute grep as root without a password.

Exploit

Fix

Improper Privilege Management

Missing Authentication

Weakness Enumeration

CWE-269

CWE-306

Related Identifiers

CVE-2020-13695

Affected Products

Quickbox Community Edition

Quickbox Pro Edition

Grep

References · 3

• 🔥 https://s1gh.sh/cve-2020-13448-quickbox-authenticated-rce · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-13695 · Security Note
• https://osv.dev/vulnerability/CVE-2020-13695 · Vendor Advisory