PT-2020-14716 · Mida · Mida Eframework

Andrea Baesso · Published 2020-07-24 · Updated 2022-01-01 · CVE-2020-15922

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Mida eFramework version 2.9.0

Description The issue allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges through an OS Command Injection. Authentication is required to exploit this issue.

Recommendations For Mida eFramework version 2.9.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2020-15922

Affected Products

Mida Eframework

References · 5

• 🔥 http://packetstormsecurity.com/files/159314/Mida-eFramework-2.8.9-Remote-Code-Execution.html · Exploit
• 🔥 https://elbae.github.io/jekyll/update/2020/07/14/vulns-01.html · Exploit
• 🔥 https://exploit-db.com/exploits/48835 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-15922 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15922 · Vendor Advisory