PT-2020-19333 · Visam · Visam Vbase Web-Remote Module+1

Published 2020-04-03 · Updated 2020-04-06 · CVE-2020-7008

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions VISAM VBASE Editor version 11.5.0.2 VISAM VBASE Web-Remote Module

Description The issue allows input passed in the URL that is not properly verified before use, which may allow an attacker to read arbitrary files from local resources.

Recommendations For VISAM VBASE Editor version 11.5.0.2, consider restricting access to the URL parameter to minimize the risk of exploitation. For VISAM VBASE Web-Remote Module, avoid using unverified input from the URL until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Relative Path Traversal

Path traversal

Weakness Enumeration

CWE-23

CWE-22

Related Identifiers

CVE-2020-7008

Affected Products

Visam Vbase Editor

Visam Vbase Web-Remote Module

References · 4

• https://osv.dev/vulnerability/CVE-2020-7008 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7008 · Security Note
• https://t.me/cvenotify/2410 · Telegram Post
• https://us-cert.gov/ics/advisories/icsa-20-084-01 · Note