PT-2020-14082 · Global Radar · Global Radar Bsa Radar

William Summerhill · Published 2020-06-22 · Updated 2023-01-30 · CVE-2020-14946

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Global RADAR BSA Radar versions 1.6.7234.24750 and earlier

Description The issue allows users to view local files on the web server by manipulating the FileName and FilePath parameters in the URL, or while using a proxy, potentially exposing sensitive files or configuration files. This is possible through the downloadFile.ashx in the Administrator section of the Surveillance module.

Recommendations For Global RADAR BSA Radar versions 1.6.7234.24750 and earlier, as a temporary workaround, consider restricting access to the downloadFile.ashx file in the Administrator section of the Surveillance module to minimize the risk of exploitation. Avoid using the FileName and FilePath parameters in the affected URL until the issue is resolved.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-14946

Affected Products

Global Radar Bsa Radar

References · 6

• 🔥 https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities/blob/master/CVE-2020-14946%20-%20Local%20File%20Inclusion.md · Exploit
• 🔥 https://github.com/wsummerhill/BSA-Radar_CVE-Vulnerabilities · Exploit
• 🔥 http://packetstormsecurity.com/files/158420/BSA-Radar-1.6.7234.24750-Local-File-Inclusion.html · Exploit
• 🔥 https://exploit-db.com/exploits/48666 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-14946 · Security Note
• https://osv.dev/vulnerability/CVE-2020-14946 · Vendor Advisory