Lucene search

K
cve[email protected]CVE-2020-15641
HistoryAug 25, 2020 - 9:15 p.m.

CVE-2020-15641

2020-08-2521:15:12
CWE-22
web.nvd.nist.gov
33
vulnerability
cve-2020-15641
marvell
qconvergeconsole
remote attack
sensitive information disclosure
authentication bypass
file upload validation
stored credentials disclosure
zdi-can-10499
nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.031 Low

EPSS

Percentile

91.0%

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Marvell QConvergeConsole 5.5.0.64. Authentication is not required to exploit this vulnerability. The specific flaw exists within the getFileUploadBytes method of the FlashValidatorServiceImpl class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-10499.

Affected configurations

Vulners
NVD
Node
marvellqconvergeconsoleRange5.5.0.64

CNA Affected

[
  {
    "product": "QConvergeConsole",
    "vendor": "Marvell",
    "versions": [
      {
        "status": "affected",
        "version": "5.5.0.64"
      }
    ]
  }
]

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.031 Low

EPSS

Percentile

91.0%

Related for CVE-2020-15641