PT-2020-19872 · Opservices+1 · Opmon+1

Published 2020-02-06 · Updated 2020-02-11 · CVE-2020-7953

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpServices OpMon version 9.3.2

Description An issue was discovered that allows reading server files without authentication, due to the use of the nmap -iL option. This could potentially expose sensitive information, such as the contents of the /etc/passwd file.

Recommendations For OpServices OpMon version 9.3.2, consider restricting access to sensitive server files and disabling the use of the nmap -iL option until a patch is available. As a temporary workaround, limit the ability to read server files to authorized personnel only. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2020-7953

Affected Products

Opmon

Nmap

References · 4

• https://osv.dev/vulnerability/CVE-2020-7953 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7953 · Security Note
• https://medium.com/%40ph0rensic/three-cves-on-opmon-3ca775a262f5 · Note
• https://medium.com/%40ph0rensic · Note