PT-2021-10794 · Safe · Fme Server

David Van Gool + 1 · Published 2021-04-28 · Updated 2021-06-17 · CVE-2020-22790

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FME Server versions 2019.2 and 2020.0 Beta

Description The issue allows a remote attacker to execute arbitrary web script or HTML by injecting malicious code via modifying the name of the users. This code is executed when an administrator accesses the logs.

Recommendations For FME Server version 2019.2, update to a version that includes the fix for this issue. For FME Server version 2020.0 Beta, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the logs for administrators until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-22790

Affected Products

Fme Server

References · 8

• 🔥 https://mexicanpentester.com/2020/04/09/vulnerabilities-in-fme-server-versions-2019-2-and-2020-0-beta-and-probably-previous-versions · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-22790 · Security Note
• https://community.safe.com/s/article/FME-Server-Stored-Cross-Site-Scripting-XSS-Vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-22790 · Vendor Advisory
• https://community.safe.com/s/article/fme-server-2019-security-update · Vendor Advisory
• https://t.me/cvenotify/14215 · Telegram Post
• https://t.me/cvenotify/15817 · Telegram Post
• https://t.me/cvenotify/16435 · Telegram Post