CVE-2020-10569

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-10569
SysAid On-Premise 20.1.11, by default, allows the AJP protocol port, which is vulnerable to a GhostCat attack. Additionally, it allows unauthenticated access to upload files, which can be used to execute commands on the system by chaining it with a GhostCat attack. NOTE: This may be a duplicate of CVE-2020-1938

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

10.0 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://packetstormsecurity.com/files/157314/Sysaid-20.1.11-b26-Remote-Command-Execution.html Exploit Third Party Advisory VDB Entry
https://www.sysaid.com/product/on-premise/20-2/release-notes Release Notes Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:sysaid:on-premise:20.1.11:*:*:*:*:*:*:*
History

07 Nov 2023, 03:14

Type Values Removed Values Added
Summary ** DISPUTED ** SysAid On-Premise 20.1.11, by default, allows the AJP protocol port, which is vulnerable to a GhostCat attack. Additionally, it allows unauthenticated access to upload files, which can be used to execute commands on the system by chaining it with a GhostCat attack. NOTE: This may be a duplicate of CVE-2020-1938. SysAid On-Premise 20.1.11, by default, allows the AJP protocol port, which is vulnerable to a GhostCat attack. Additionally, it allows unauthenticated access to upload files, which can be used to execute commands on the system by chaining it with a GhostCat attack. NOTE: This may be a duplicate of CVE-2020-1938

25 Feb 2021, 17:07

Type Values Removed Values Added
References (MISC) https://www.sysaid.com/product/on-premise/20-2/release-notes - (MISC) https://www.sysaid.com/product/on-premise/20-2/release-notes - Release Notes, Vendor Advisory

16 Feb 2021, 19:15

Type Values Removed Values Added
Summary SysAid On-Premise 20.1.11, by default, allows the AJP protocol port, which is vulnerable to a GhostCat attack. Additionally, it allows unauthenticated access to upload files, which can be used to execute commands on the system by chaining it with a GhostCat attack. ** DISPUTED ** SysAid On-Premise 20.1.11, by default, allows the AJP protocol port, which is vulnerable to a GhostCat attack. Additionally, it allows unauthenticated access to upload files, which can be used to execute commands on the system by chaining it with a GhostCat attack. NOTE: This may be a duplicate of CVE-2020-1938.
References
  • (MISC) https://www.sysaid.com/product/on-premise/20-2/release-notes -
Information

Published : 2020-04-21 19:15

Updated : 2024-05-17 01:41

NVD link : CVE-2020-10569

Mitre link : CVE-2020-10569

CVE.ORG link : CVE-2020-10569

JSON object : View

Products Affected

sysaid

  • on-premise
CWE
CWE-434

Unrestricted Upload of File with Dangerous Type