PT-2020-20507 · Huawei · Manageone

Published 2020-11-30 · Updated 2021-07-21 · CVE-2020-9115

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ManageOne versions 6.5.1.1.B010 through 6.5.1.1.B050, 8.0.0, 8.0.1

Description The issue is related to a command injection vulnerability. An attacker with high privileges may exploit this vulnerability through some operations on the plug-in component. Due to insufficient input validation of some parameters, the attacker can exploit this vulnerability to inject commands to the target device.

Recommendations For versions 6.5.1.1.B010 through 6.5.1.1.B050, consider restricting access to the plug-in component to minimize the risk of exploitation. For versions 8.0.0 and 8.0.1, consider implementing additional input validation measures for parameters to prevent command injection. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

RCE

Weakness Enumeration

CWE-77

CWE-20

Related Identifiers

CVE-2020-9115

Affected Products

Manageone

References · 4

• https://osv.dev/vulnerability/CVE-2020-9115 · Vendor Advisory
• https://huawei.com/en/psirt/security-advisories/huawei-sa-20201125-01-commandinjection-en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9115 · Security Note
• https://t.me/cibsecurity/16962 · Telegram Post