Lucene search

OpenTextCVE-2020-11847

HistoryAug 21, 2024 - 2:15 p.m.

CVE-2020-11847

2024-08-2114:15:07

CWE-78

OpenText

web.nvd.nist.gov

ssh

pam server

os command

full system access

privileged access manager

cve-2020-11847

security issue

CVSS3

8.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

0.002

Percentile

55.2%

JSON

SSH authenticated user when access the PAM server can execute an OS command to gain the full system access using bash. This issue affects Privileged Access Manager before 3.7.0.1.

Affected configurations

Nvd

Node

microfocusnetiq_privileged_access_managerRange<3.7

microfocusnetiq_privileged_access_managerMatch3.7-

VendorProductVersionCPE
microfocusnetiq_privileged_access_manager*cpe:2.3:a:microfocus:netiq_privileged_access_manager:*:*:*:*:*:*:*:*
microfocusnetiq_privileged_access_manager3.7cpe:2.3:a:microfocus:netiq_privileged_access_manager:3.7:-:*:*:*:*:*:*

Vendor	Product	Version	CPE
microfocus	netiq_privileged_access_manager	*	cpe:2.3:a:microfocus:netiq_privileged_access_manager::::::::
microfocus	netiq_privileged_access_manager	3.7	cpe:2.3:a:microfocus:netiq_privileged_access_manager:3.7:-::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows",
      "Linux",
      "64 bit",
      "32 bit"
    ],
    "product": "Privileged Access Manager",
    "vendor": "OpenText",
    "versions": [
      {
        "lessThan": "<",
        "status": "affected",
        "version": "3.7.0.1",
        "versionType": "server"
      }
    ]
  }
]

References

www.netiq.com/documentation/privileged-account-manager-37/npam_3701_releasenotes/data/npam_3701_releasenotes.html

CVSS3

8.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

0.002

Percentile

55.2%

JSON

Related for CVE-2020-11847