CVE-2020-15492

Katalog CVE

CVSS 9.8 · Critical EPSS 16,6%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada inneo startup tools. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An issue was discovered in INNEO Startup TOOLS 2017 M021 12.0.66.3784 through 2018 M040 13.0.70.3804. The sut_srv.exe web application (served on TCP port 85) includes user input into a filesystem access without any further validation. This might allow an unauthenticated attacker to read files on the server via Directory Traversal, or possibly have unspecified other impact.

Rincian

Terbit di NVD

23 Juli 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

EPSS (30 hari)

16,6% peluang dieksploitasi; lebih tinggi dari 96,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.inneo.co.uk/en/product-development/inneo-in-house-products/startup-tools.html product · advisory vendor
• https://www.inneo.de/files/content/Produktentwicklung/Tools-und-Erweiterungen/Startup-TOOLS/INNEO-SA-SUT-2020-... advisory vendor
• http://packetstormsecurity.com/files/158556/INNEO-Startup-TOOLS-2018-M040-13.0.70.3804-Remote-Code-Execution.h... exploit · advisory pihak ketiga
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-028.txt exploit · advisory pihak ketiga
• https://www.syss.de/pentest-blog/2020/syss-2020-028-sicherheitsschwachstelle-in-inneo-startup-tools-2017-und-2... advisory pihak ketiga