EUVD-2020-4572

Malware in sbrugna...

CVE-2020-12258

rConfig 3.9.4 is vulnerable to session fixation because session expiry and randomization are mishandled. The application can reuse a session via PHPSESSID. Also, an attacker can exploit this vulnerability in conjunction with CVE-2020-12256 or CVE-2020-12259...

Session fixation

rConfig 3.9.4 is vulnerable to session fixation because session expiry and randomization are mishandled. The application can reuse a session via PHPSESSID. Also, an attacker can exploit this vulnerability in conjunction with CVE-2020-12256 or CVE-2020-12259...

CVE-2020-12256

rConfig 3.9.4 is affected by CVE-2020-12256: a reflected XSS in the devicemgmnt.php, exploitable via the deviceId GET parameter to inject arbitrary JavaScript. The NUCLEI template confirms the flaw and notes an impact where authenticated attackers can inject code, potentially stealing session coo...

CVE-2020-12258

rConfig 3.9.4 is affected by multiple CVEs with concrete details in connected docs. Affected product/component: rConfig 3.9.4 (devicemgmnt.php and related input handling). Root cause: inadequate validation of user-controlled input leading to cross-site scripting (CVE-2020-12256, CVE-2020-12259) a...