PT-2020-16089 · Crmeb · Crmeb

Viktorwkxstar · Published 2020-10-23 · Updated 2020-10-27 · CVE-2020-25466

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CRMEB version 3.0

Description A SSRF issue exists in the downloadimage interface, allowing remote download of arbitrary files on the server and potentially enabling remote execution of arbitrary code.

Recommendations For CRMEB version 3.0, consider restricting access to the downloadimage interface as a temporary workaround until a patch is available.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2020-25466

Affected Products

Crmeb

References · 5

• 🔥 https://github.com/crmeb/CRMEB/issues/22 · Exploit
• https://osv.dev/vulnerability/CVE-2020-25466 · Vendor Advisory
• http://crmeb.com · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25466 · Security Note
• https://github.com/crmeb/CRMEB · Note