CVE-2020-8868

Опубликовано: 23 мар. 2020

Источник: nvd

CVSS3: 9.8

CVSS2: 10

EPSS Средний

Описание

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight Evolve 9.0.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the service user account. The product contains a hard-coded password for this account. An attacker can leverage this vulnerability to execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-9553.

Ссылки

https://support.quest.com/foglight/kb/315091/fms-5-9-5-hotfix-hfix-314
Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-290/
Third Party Advisory
VDB Entry
https://support.quest.com/foglight/kb/315091/fms-5-9-5-hotfix-hfix-314
Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-290/
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:quest:foglight_evolve:9.0.0:*:*:*:*:*:*:*

EPSS

Процентиль: 96%

0.25682

Средний

9.8 Critical

CVSS3

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-798

Связанные уязвимости

GHSA-6q8f-ff55-86rj

github

больше 3 лет назад

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight Evolve 9.0.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the __service__ user account. The product contains a hard-coded password for this account. An attacker can leverage this vulnerability to execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-9553.

BDU:2020-01231

CVSS3: 9.8

fstec

около 6 лет назад

Уязвимость компонента CommandLineService платформы Foglight Evolve, связанная с использованием жестко закодированных учетных данных пользователя «__service__ user», позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 96%

0.25682

Средний

9.8 Critical

CVSS3

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-798