CRITICAL
An issue was discovered in URVE Build 24.03.2020
Published Dec 23, 2020
9.8
CRITICALCVSS 3.1
EPSS 4.88%
Description
An issue was discovered in URVE Build 24.03.2020. By using the _internal/pc/vpro.php?mac=0&ip=0&operation=0&usr=0&pass=0%3bpowershell+-c+" substring, it is possible to execute a Powershell command and redirect its output to a file under the web root.
Affected products
Remediation
No remediation recorded yet.
Weaknesses (1)
References (4)
- http://packetstormsecurity.com/files/160722/URVE-Software-Build-24.03.2020-Authentication-Bypass-Remote-Code-Execution.html x_refsource_MISCExploitThird Party AdvisoryVDB Entry
- http://seclists.org/fulldisclosure/2020/Dec/47 mailing-listx_refsource_FULLDISCExploitMailing ListThird Party Advisory
- https://urve.co.uk/system-rezerwacji-sal x_refsource_MISCVendor Advisory
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-040.txt x_refsource_MISCExploitThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| http://packetstormsecurity.com/files/160722/URVE-Software-Build-24.03.2020-Authentication-Bypass-Remote-Code-Execution.html | x_refsource_MISCExploitThird Party AdvisoryVDB Entry | |
| http://seclists.org/fulldisclosure/2020/Dec/47 | mailing-listx_refsource_FULLDISCExploitMailing ListThird Party Advisory | |
| https://urve.co.uk/system-rezerwacji-sal | x_refsource_MISCVendor Advisory | |
| https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-040.txt | x_refsource_MISCExploitThird Party Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Dec 23, 2020
Updated Aug 4, 2024
Reserved Dec 4, 2020
Link CVE-2020-29552
CISA Vulnrichment
Updated n/a