PT-2020-16238 · Nhi · Nhiservisignadapter

Angelboy + 1 · Published 2020-12-31 · Updated 2021-01-04 · CVE-2020-25842

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions NHIServiSignAdapter (affected versions not specified)

Description The issue concerns the encryption function of NHIServiSignAdapter, which fails to properly verify the file path input by users. This flaw allows a remote attacker to access arbitrary files without requiring privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-311

Related Identifiers

CVE-2020-25842

Affected Products

Nhiservisignadapter

References · 3

• https://osv.dev/vulnerability/CVE-2020-25842 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25842 · Security Note
• https://twcert.org.tw/tw/cp-132-4270-72392-1.html · Note