PT-2020-13996 · Aapanel · Aapanel

Jenaye · Published 2020-06-18 · Updated 2023-01-27 · CVE-2020-14421

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions aaPanel versions 6.6.6 and earlier

Description The issue allows remote authenticated users to execute arbitrary commands via the Script Content box on the Add Cron Job screen. This can be done by exploiting the vulnerability in the Script Content box, which is part of the Add Cron Job functionality.

Recommendations For versions 6.6.6 and earlier, consider disabling the Add Cron Job feature or restricting access to the Script Content box until a patch is available. As a temporary workaround, restrict the use of the Script Content box to minimize the risk of exploitation.

Exploit

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2020-14421

Affected Products

Aapanel

References · 6

• 🔥 https://github.com/jenaye/aapanel · Exploit
• 🔥 http://packetstormsecurity.com/files/159575/aaPanel-6.6.6-Privilege-Escalation.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-14421 · Security Note
• https://osv.dev/vulnerability/CVE-2020-14421 · Vendor Advisory
• https://t.me/cvenotify/4463 · Telegram Post
• https://forum.aapanel.com · Note