PT-2020-16242 · Nhi · Nhiservisignadapter

Angelboy + 1 · Published 2020-12-31 · Updated 2021-01-06 · CVE-2020-25846

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions NHIServiSignAdapter (affected versions not specified)

Description The issue concerns the digest generation function of NHIServiSignAdapter, which has not been properly verified for the source file path. This oversight allows the SMB request to be redirected to a malicious host, resulting in the leakage of the user's credential.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2020-25846

Affected Products

Nhiservisignadapter

References · 3

• https://osv.dev/vulnerability/CVE-2020-25846 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25846 · Security Note
• https://twcert.org.tw/tw/cp-132-4274-7bd65-1.html · Note