Sign-up

ID

VAR-202101-0413


CVE

CVE-2020-27859


TITLE

NEC ESMPRO Manager  Traversal Vulnerability in Japan

Trust: 0.8

sources: JVNDB: JVNDB-2020-015594

DESCRIPTION

This vulnerability allows remote attackers to disclose sensitive information on affected installations of NEC ESMPRO Manager 6.42. Authentication is not required to exploit this vulnerability. The specific flaw exists within the GetEuaLogDownloadAction class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM. Was ZDI-CAN-9607. NEC ESMPRO Manager Contains a path traversal vulnerability. Zero Day Initiative To this vulnerability ZDI-CAN-9607 Was numbered.Information may be obtained

Trust: 2.34

sources: NVD: CVE-2020-27859 // JVNDB: JVNDB-2020-015594 // ZDI: ZDI-20-736 // VULMON: CVE-2020-27859

AFFECTED PRODUCTS

vendor:necmodel:esmpro managerscope:eqversion:6.42

Trust: 1.0

vendor:日本電気model:esmpro/servermanagerscope:eqversion:6.42

Trust: 0.8

vendor:日本電気model:esmpro/servermanagerscope:eqversion: -

Trust: 0.8

vendor:necmodel:esmpro managerscope: - version: -

Trust: 0.7

sources: ZDI: ZDI-20-736 // JVNDB: JVNDB-2020-015594 // NVD: CVE-2020-27859

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-27859
value: HIGH

Trust: 1.0

zdi-disclosures@trendmicro.com: CVE-2020-27859
value: HIGH

Trust: 1.0

NVD: CVE-2020-27859
value: HIGH

Trust: 0.8

ZDI: CVE-2020-27859
value: HIGH

Trust: 0.7

CNNVD: CNNVD-202101-1563
value: HIGH

Trust: 0.6

VULMON: CVE-2020-27859
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2020-27859
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

zdi-disclosures@trendmicro.com: CVE-2020-27859
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.0

Trust: 1.8

nvd@nist.gov: CVE-2020-27859
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

ZDI: CVE-2020-27859
baseSeverity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-20-736 // VULMON: CVE-2020-27859 // JVNDB: JVNDB-2020-015594 // CNNVD: CNNVD-202101-1563 // NVD: CVE-2020-27859 // NVD: CVE-2020-27859

PROBLEMTYPE DATA

problemtype:CWE-22

Trust: 1.0

problemtype:Path traversal (CWE-22) [NVD Evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2020-015594 // NVD: CVE-2020-27859

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202101-1563

TYPE

path traversal

Trust: 0.6

sources: CNNVD: CNNVD-202101-1563

PATCH

title:patch / Correction moduleurl:https://jpn.nec.com/esmsm/imp_info.html

Trust: 0.8

title:NEC ESMPRO Manager Repair measures for path traversal vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=139934

Trust: 0.6

sources: JVNDB: JVNDB-2020-015594 // CNNVD: CNNVD-202101-1563

EXTERNAL IDS

db:NVDid:CVE-2020-27859

Trust: 3.2

db:ZDIid:ZDI-20-736

Trust: 3.2

db:JVNDBid:JVNDB-2020-015594

Trust: 0.8

db:ZDI_CANid:ZDI-CAN-9607

Trust: 0.7

db:CNNVDid:CNNVD-202101-1563

Trust: 0.6

db:VULMONid:CVE-2020-27859

Trust: 0.1

sources: ZDI: ZDI-20-736 // VULMON: CVE-2020-27859 // JVNDB: JVNDB-2020-015594 // CNNVD: CNNVD-202101-1563 // NVD: CVE-2020-27859

REFERENCES

url:https://www.zerodayinitiative.com/advisories/zdi-20-736/

Trust: 2.5

url:https://nvd.nist.gov/vuln/detail/cve-2020-27859

Trust: 1.4

url:https://cwe.mitre.org/data/definitions/22.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULMON: CVE-2020-27859 // JVNDB: JVNDB-2020-015594 // CNNVD: CNNVD-202101-1563 // NVD: CVE-2020-27859

CREDITS

rgod

Trust: 0.7

sources: ZDI: ZDI-20-736

SOURCES

db:ZDIid:ZDI-20-736
db:VULMONid:CVE-2020-27859
db:JVNDBid:JVNDB-2020-015594
db:CNNVDid:CNNVD-202101-1563
db:NVDid:CVE-2020-27859

LAST UPDATE DATE

2024-11-23T23:04:07.667000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-20-736date:2020-12-04T00:00:00
db:VULMONid:CVE-2020-27859date:2021-01-26T00:00:00
db:JVNDBid:JVNDB-2020-015594date:2021-10-06T02:57:00
db:CNNVDid:CNNVD-202101-1563date:2021-02-01T00:00:00
db:NVDid:CVE-2020-27859date:2024-11-21T05:21:56.887

SOURCES RELEASE DATE

db:ZDIid:ZDI-20-736date:2020-06-25T00:00:00
db:VULMONid:CVE-2020-27859date:2021-01-20T00:00:00
db:JVNDBid:JVNDB-2020-015594date:2021-10-06T00:00:00
db:CNNVDid:CNNVD-202101-1563date:2021-01-20T00:00:00
db:NVDid:CVE-2020-27859date:2021-01-20T20:15:12.847