Improper input validation in Checkpoint Ica Management Portal

CVE-2020-6020

Check Point Security Management's Internal CA web management before Jumbo HFAs R80.10 Take 278, R80.20 Take 160, R80.30 Take 210, and R80.40 Take 38, can be manipulated to run commands as a high privileged user or crash, due to weak input validation on inputs by a trusted management administrator.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.005 (40.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.4 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L.

Affected products

  • Checkpoint Ica_management_portal — versions r80.20, r80.30, r80.40
  • N/a Ica Management Portal — versions before JHFs R80.20 Take 160, R80.30 Take 210, and R80.40 Take 38

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2020-6020?
CVE-2020-6020 is a medium-severity vulnerability in Checkpoint Ica Management Portal, classified under Improper Input Validation. CVSS score: 6.4/10. Published 2020-09-24.
How severe is CVE-2020-6020?
Medium severity. CVSS v3 base score is 6.4 out of 10.
Is CVE-2020-6020 known to be exploited?
1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.