admin/cvelist
1
0
Fork 0
mirror of https://github.com/CVEProject/cvelist.git synced 2025-06-10 02:04:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

add CVE-2020-15086 for GHSA-4h44-w6fm-548g

Browse Source
This commit is contained in:
Robert Schultheis 2020-07-29 09:33:16 -06:00
parent e5a9b5b33b
commit 9d7dd5171d
No known key found for this signature in database
GPG Key ID: 348C4211B4D8BB40
1 changed files with 105 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

111
2020/15xxx/CVE-2020-15086.json
View File

@ -1,18 +1,117 @@
{
"data_type": "CVE",
"data_format": "MITRE",
"data_version": "4.0",
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2020-15086",
"ASSIGNER": "cve@mitre.org",
"STATE": "RESERVED"
"STATE": "PUBLIC",
"TITLE": "Potential Remote Code Execution in TYPO3 with mediace extension"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "mediace",
"version": {
"version_data": [
{
"version_value": ">= 7.6.2, < 7.6.5"
}
]
}
}
]
},
"vendor_name": "FriendsOfTYPO3"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
"value": "In TYPO3 installations with the \"mediace\" extension from version 7.6.2 and before version 7.6.5, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. The allows to inject arbitrary data having a valid cryptographic message authentication code and can lead to remote code execution.\n\nTo successfully exploit this vulnerability, an attacker must have access to at least one `Extbase` plugin or module action in a TYPO3 installation.\n\nThis is fixed in version 7.6.5 of the \"mediace\" extension for TYPO3."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "{\"CWE-20\":\"Improper Input Validation\"}"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "{\"CWE-325\":\"Missing Required Cryptographic Step\"}"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "{\"CWE-502\":\"Deserialization of Untrusted Data\"}"
}
]
},
{
"description": [
{
"lang": "eng",
"value": "CWE-200 Information Exposure"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/FriendsOfTYPO3/mediace/security/advisories/GHSA-4h44-w6fm-548g",
"refsource": "CONFIRM",
"url": "https://github.com/FriendsOfTYPO3/mediace/security/advisories/GHSA-4h44-w6fm-548g"
},
{
"name": "https://github.com/FriendsOfTYPO3/mediace/commit/fa29ffd3e8b275782a8600d2406e1b1e5e16ae75",
"refsource": "MISC",
"url": "https://github.com/FriendsOfTYPO3/mediace/commit/fa29ffd3e8b275782a8600d2406e1b1e5e16ae75"
},
{
"name": "https://github.com/FriendsOfTYPO3/mediace/pull/31",
"refsource": "MISC",
"url": "https://github.com/FriendsOfTYPO3/mediace/pull/31"
}
]
},
"source": {
"advisory": "GHSA-4h44-w6fm-548g",
"discovery": "UNKNOWN"
}
}