RCE in Certtools Intelmq Manager
CVE-2020-11016
IntelMQ Manager from version 1.1.0 and before version 2.1.1 has a vulnerability where the backend incorrectly handled messages given by user-input in the "send" functionality of the Inspect-tool of the Monitor component. An attacker with access to the IntelMQ Manager could possibly use this issue to execute arbitrary code with the privileges of the webserver. Version 2.1.1 fixes the vulnerability.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L.
EPSS exploit prediction
EPSS: 0.023 (83.0th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 83rd percentile — 83.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.023 · newest: 0.023 · change: 0.000
Affected products
- Certtools Intelmq Manager — versions >= 1.1.0, < 2.1.1
- Intelmq Manager Project
Weakness classification (CWE)
References
- github.com/certtools/intelmq-manager/security/advisories/GHSA-rrhh-rcgp-q2m2 (Patch, Third Party Advisory)
- github.com/certtools/intelmq-manager/commit/b9a2ac43a4f99d764b827108f6a99dc4a9f… (Patch, Third Party Advisory)
- github.com/certtools/intelmq-manager/releases/tag/2.1.1 (Third Party Advisory)
- lists.cert.at/pipermail/intelmq-users/2020-April/000161.html (Third Party Advisory)
Frequently asked questions
- What is CVE-2020-11016?
- CVE-2020-11016 is a critical-severity vulnerability in Certtools Intelmq Manager, classified under OS Command Injection. CVSS score: 9.1/10. Published 2020-04-30.
- How severe is CVE-2020-11016?
- Critical severity. CVSS v3 base score is 9.1 out of 10.