PT-2021-10793 · Safe · Fme Server

David Van Gool + 1 · Published 2021-04-28 · Updated 2021-06-17 · CVE-2020-22789

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FME Server versions 2019.2 and 2020.0 Beta

Description The issue allows a remote attacker to gain admin privileges by injecting arbitrary web script or HTML via the login page. The malicious script is executed when an administrator accesses the logs.

Recommendations For FME Server version 2019.2, update to a version that contains a fix for this issue. For FME Server version 2020.0 Beta, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the login page and the logs to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-22789

Affected Products

Fme Server

References · 8

• 🔥 https://mexicanpentester.com/2020/04/09/vulnerabilities-in-fme-server-versions-2019-2-and-2020-0-beta-and-probably-previous-versions · Exploit
• https://osv.dev/vulnerability/CVE-2020-22789 · Vendor Advisory
• https://community.safe.com/s/article/FME-Server-Stored-Cross-Site-Scripting-XSS-Vulnerabilities · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-22789 · Security Note
• https://community.safe.com/s/article/fme-server-2019-security-update · Vendor Advisory
• https://t.me/cvenotify/16436 · Telegram Post
• https://t.me/cvenotify/14214 · Telegram Post
• https://t.me/cvenotify/15818 · Telegram Post