PT-2020-17798 · Armorx · Lisomail

Tony Kuo · Published 2020-03-18 · Updated 2020-03-19 · CVE-2020-3922

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LisoMail, by ArmorX (affected versions not specified)

Description The issue allows SQL Injections, enabling attackers to access the database without authentication by manipulating a URL parameter.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-3922

Affected Products

Lisomail

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-3922 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3922 · Vendor Advisory
• https://t.me/cvenotify/1842 · Telegram Post
• https://twcert.org.tw/tw/cp-132-3437-17241-1.html · Note
• https://gist.github.com/tonykuo76/50350af9b77eb51f5ab55964a35f47f2 · Note
• https://chtsecurity.com/news/2fd99e6e-819f-42b4-a7fe-6bc7eeae155c · Note