PT-2020-19605 · Igss · Igss

Published 2020-03-23 · Updated 2022-10-07 · CVE-2020-7478

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IGSS versions 14 and prior

Description A CWE-22 issue exists, which could allow a remote unauthenticated attacker to read arbitrary files from the IGSS server PC on an unrestricted or shared network when the IGSS Update Service is enabled. This issue affects the IGSSupdate service.

Recommendations For IGSS versions 14 and prior, disable the IGSS Update Service to prevent exploitation until a patch is available. Restrict access to the IGSS server PC on shared networks to minimize the risk of arbitrary file reading.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-7478

ZDI-20-371

Affected Products

Igss

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-7478 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-371 · Security Note
• https://osv.dev/vulnerability/CVE-2020-7478 · Vendor Advisory
• https://se.com/ww/en/download/document/SEVD-2020-070-01 · Vendor Advisory
• https://t.me/cvenotify/2040 · Telegram Post