PT-2021-9159 · Invigo · Invigo Automatic Device Management

Published 2021-03-25 · Updated 2021-03-26 · CVE-2020-10584

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Invigo Automatic Device Management (ADM) versions prior to 5.0

Description The issue concerns a directory traversal attack on the /admin/search by.php script, allowing remote attackers to read arbitrary server files accessible to the user running the application.

Recommendations For Invigo Automatic Device Management (ADM) versions prior to 5.0, update to version 5.0 or later to resolve the issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2020-10584

Affected Products

Invigo Automatic Device Management

References · 3

• https://osv.dev/vulnerability/CVE-2020-10584 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10584 · Security Note
• https://on-x.com/sites/default/files/security_advisory_-_multiple_vulnerabilities_-_invigo_adm.pdf · Note