PT-2020-14602 · Rconfig · Rconfig

Published 2020-07-28 · Updated 2020-07-28 · CVE-2020-15715

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions rConfig version 3.9.5

Description The issue is caused by an error in the search.crud.php script, allowing a remote authenticated attacker to execute arbitrary code on the system. The nodeId parameter can be exploited to achieve this.

Recommendations For version 3.9.5, avoid using the nodeId parameter in the affected script until a fix is available. As a temporary workaround, consider restricting access to the search.crud.php script to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2020-15715

Affected Products

Rconfig

References · 4

• https://rconfig.com/downloads/v3-release-notes · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15715 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15715 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/184941 · Note