PT-2021-11630 · Secomea · Secomea Gatemanager

Published 2021-02-16 · Updated 2021-02-26 · CVE-2020-29023

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Secomea GateManager versions prior to 9.3

Description: The issue is related to improper encoding or escaping of output from the CSV Report Generator, allowing an authenticated administrator to generate a CSV file that can run arbitrary commands on a victim's computer when opened in a spreadsheet program, such as Excel.

Recommendations: For Secomea GateManager versions prior to 9.3, update to version 9.3 or later to resolve the issue. As a temporary workaround, consider avoiding the use of the CSV Report Generator until a patch is applied. Restrict access to the CSV Report Generator feature to minimize the risk of exploitation.

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2020-29023

Affected Products

Secomea Gatemanager

References · 5

• https://secomea.com/support/cybersecurity-advisory/#2418 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-29023 · Security Note
• https://osv.dev/vulnerability/CVE-2020-29023 · Vendor Advisory
• https://secomea.com/support/cybersecurity-advisory · Vendor Advisory
• https://t.me/cibsecurity/23641 · Telegram Post