CVE-2020-11467

{"id": "CVE-2020-11467", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2020-04-01T21:15:14.317", "references": [{"url": "https://blog.redforce.io/attacking-helpdesks-part-1-rce-chain-on-deskpro/", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://support.deskpro.com/en/news/posts/deskpro-security-update-2019-09", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://support.deskpro.com/en/news/posts/deskpro-v2019-8-0-released-security-update", "tags": ["Release Notes", "Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-502"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in Deskpro before 2019.8.0. This product enables administrators to modify the helpdesk interface by editing /portal/api/style/edit-theme-set/template-sources theme templates, and uses TWIG as its template engine. While direct access to self and _self variables was not permitted, one could abuse the accessible variables in one's context to reach a native unserialize function via the code parameter. There, on could pass a crafted payload to trigger a set of POP gadgets in order to achieve remote code execution."}, {"lang": "es", "value": "Se detect\u00f3 un problema en Deskpro versiones anteriores a 2019.8.0. Este producto permite a los administradores modificar la interfaz del servicio de asistencia (helpdesk) mediante la edici\u00f3n de plantillas de tema /portal/api/style/edit-theme-set/template-sources, y usa TWIG como su motor de plantillas. Mientras el acceso directo a las variables self y _self no estaba permitido, uno podr\u00eda abusar de las variables accesibles en su contexto para alcanzar una funci\u00f3n nativa no serializada por medio del par\u00e1metro code. All\u00ed, podr\u00eda pasar una carga \u00fatil dise\u00f1ada para activar un conjunto de gadgets POP para as\u00ed lograr una ejecuci\u00f3n de c\u00f3digo remota."}], "lastModified": "2021-07-21T11:39:23.747", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:deskpro:deskpro:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FC810F59-EA83-4340-8C19-5F995C4284E5", "versionEndExcluding": "2019.8.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}