PT-2020-13993 · Remedia It · Nedi

Farid007 · Published 2020-06-29 · Updated 2020-07-06 · CVE-2020-14412

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions NeDi version 1.9C

Description The issue allows for Remote Command Execution due to improper escaping of shell metacharacters from a POST request in System-Snapshot.php. An attacker can exploit this by sending a crafted payload containing shell metacharacters via a POST request with the psw parameter. This can also be exploited through Cross-Site Request Forgery (CSRF).

Recommendations For NeDi version 1.9C, as a temporary workaround, consider restricting access to the System-Snapshot.php file to minimize the risk of exploitation. Avoid using the psw parameter in the affected POST request until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-14412

Affected Products

Nedi

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2020-14412 · Security Note
• https://osv.dev/vulnerability/CVE-2020-14412 · Vendor Advisory
• https://gist.github.com/farid007/c0df57620a3cc1fb565bc77a945aa3fd · Note