PT-2020-14478 · Redgate+1 · Redgate Sql Monitor+1

Published 2020-07-09 · Updated 2021-07-21 · CVE-2020-15526

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Redgate SQL Monitor versions 7.1.4 through 10.1.6

Description The issue allows the scope for disabling some TLS security certificate checks to extend beyond the defined options, making the software vulnerable to potential man-in-the-middle attacks when sending alert notification emails, posting to Slack, or posting to webhooks. This affects the monitoring of VMware machines as well, where these TLS security checks are ignored.

Recommendations For versions 7.1.4 through 10.1.6, update to version 10.1.7 to resolve the issue.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2020-15526

Affected Products

Redgate Sql Monitor

Vmware

References · 4

• https://red-gate.com/privacy-and-security/vulnerabilities/2020-07-08-sql-monitor · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15526 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15526 · Vendor Advisory
• https://t.me/cvenotify/4951 · Telegram Post