PT-2020-20743 · Oracle+1 · Java Rmi Server+1

Published 2020-03-04 · Updated 2021-07-21 · CVE-2020-9761

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions UNCTAD ASYCUDA World versions 2001 through 2020

Description The Java RMI Server in UNCTAD ASYCUDA World has an insecure default configuration. This leads to Java code execution from a remote URL because an RMI Distributed Garbage Collector method is called.

Recommendations For versions 2001 through 2020, consider reconfiguring the Java RMI Server to secure its default settings, focusing on proper configuration of the RMI Distributed Garbage Collector method to prevent remote code execution. As a temporary workaround, restrict access to the Java RMI Server until a secure configuration can be implemented.

Fix

Related Identifiers

CVE-2020-9761

Affected Products

Java Rmi Server

Unctad Asycuda World

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-9761 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9761 · Vendor Advisory
• https://unctad.org/en/Pages/DTL/TTL/ASYCUDA-Programme.aspx · Note
• https://pastebin.com/jP4thzzG · Note
• https://t.me/cvenotify/1317 · Telegram Post