CVE-2020-17504

Опубликовано: 08 янв. 2021

Источник: nvd

CVSS3: 7.2

CVSS2: 6.5

EPSS Низкий

Описание

The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in ngpsystemcmd.php in which the http parameters "x_modules" and "y_modules" are not properly handled. The NDN-210 is part of Barco TransForm N solution and this vulnerability is patched from TransForm N version 3.8 onwards.

Ссылки

https://www.barco.com/en/support/cms
Vendor Advisory
https://www.barco.com/en/support/knowledge-base/kb11589
Vendor Advisory
https://www.barco.com/en/support/transform-n-management-server
Product
Vendor Advisory
https://www.barco.com/en/support/cms
Vendor Advisory
https://www.barco.com/en/support/knowledge-base/kb11589
Vendor Advisory
https://www.barco.com/en/support/transform-n-management-server
Product
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:barco:transform_n:*:*:*:*:*:*:*:*

Версия до 3.8 (исключая)

Одно из

cpe:2.3:h:barco:transform_ndn-210_lite:-:*:*:*:*:*:*:*

cpe:2.3:h:barco:transform_ndn-210_pro:-:*:*:*:*:*:*:*

cpe:2.3:h:barco:transform_ndn-211_lite:-:*:*:*:*:*:*:*

cpe:2.3:h:barco:transform_ndn-211_pro:-:*:*:*:*:*:*:*

EPSS

Процентиль: 89%

0.04662

Низкий

7.2 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-77

Связанные уязвимости

GHSA-m596-2w5j-7vgh

github

больше 3 лет назад