Lucene search

GitHub_MCVE-2020-5292

HistoryMar 31, 2020 - 7:15 p.m.

CVE-2020-5292

2020-03-3119:15:14

CWE-89

GitHub_M

web.nvd.nist.gov

cve-2020-5292

leantime

sql injection

vulnerability

security issue

data exfiltration

patch available

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.002

Percentile

53.6%

JSON

Leantime before versions 2.0.15 and 2.1-beta3 has a SQL Injection vulnerability. The impact is high. Malicious users/attackers can execute arbitrary SQL queries negatively affecting the confidentiality, integrity, and availability of the site. Attackers can exfiltrate data like the users’ and administrators’ password hashes, modify data, or drop tables. The unescaped parameter is “searchUsers” when sending a POST request to “/tickets/showKanban” with a valid session. In the code, the parameter is named “users” in class.tickets.php. This issue is fixed in versions 2.0.15 and 2.1.0 beta 3.

Affected configurations

Nvd

Vulners

Node

leantimeleantimeRange<2.0.15

VendorProductVersionCPE
leantimeleantime*cpe:2.3:a:leantime:leantime:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
leantime	leantime	*	cpe:2.3:a:leantime:leantime::::::::

CNA Affected

[
  {
    "product": "Leantime",
    "vendor": "Leantime",
    "versions": [
      {
        "status": "affected",
        "version": "< 2.0.15"
      }
    ]
  }
]

References

github.com/Leantime/leantime/commit/af0807f0b2c4c3c914b93f1c5d940e6b875f231f

github.com/Leantime/leantime/pull/181

github.com/Leantime/leantime/security/advisories/GHSA-ww6x-rhvp-55hp

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.9

Confidence

High

EPSS

0.002

Percentile

53.6%

JSON

Related for CVE-2020-5292