PT-2020-14562 · Marvell · Marvell Qconvergeconsole

Rgod · Published 2020-08-10 · Updated 2020-08-28 · CVE-2020-15640

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Marvell QConvergeConsole version 5.5.0.64

Description This issue allows remote attackers to disclose sensitive information without requiring authentication. The problem exists within the getFileUploadBytes method of the FlashValidatorServiceImpl class due to inadequate validation of a user-supplied path before using it in file operations. An attacker can exploit this to disclose stored credentials, potentially leading to further compromise.

Recommendations For Marvell QConvergeConsole version 5.5.0.64, consider disabling the getFileUploadBytes method of the FlashValidatorServiceImpl class as a temporary workaround until a patch is available. Restrict access to sensitive files and directories to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-15640

ZDI-20-968

Affected Products

Marvell Qconvergeconsole

References · 4

• https://marvell.com/content/dam/marvell/en/public-collateral/fibre-channel/marvell-fibre-channel-security-advisory-2020-07.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15640 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15640 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-20-968 · Security Note