Lucene search

[email protected]CVE-2020-5616

HistoryAug 04, 2020 - 2:15 a.m.

CVE-2020-5616

2020-08-0402:15:11

CWE-287

[email protected]

web.nvd.nist.gov

cve

security

authentication bypass

administrative privileges

remote attack

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.071 Low

EPSS

Percentile

94.0%

JSON

[Calendar01], [Calendar02], [PKOBO-News01], [PKOBO-vote01], [Telop01], [Gallery01], [CalendarForm01], and [Link01] [Calendar01] free edition ver1.0.0, [Calendar02] free edition ver1.0.0, [PKOBO-News01] free edition ver1.0.3 and earlier, [PKOBO-vote01] free edition ver1.0.1 and earlier, [Telop01] free edition ver1.0.0, [Gallery01] free edition ver1.0.3 and earlier, [CalendarForm01] free edition ver1.0.3 and earlier, and [Link01] free edition ver1.0.0 allows remote attackers to bypass authentication and log in to the product with administrative privileges via unspecified vectors.

Affected configurations

NVD

Node

calendar01_projectcalendar01Match1.0.0free

calendar02_projectcalendar02Match1.0.0free

calendarform01_projectcalendarform01Range≤1.0.3free

gallery01_projectgallery01Range≤1.0.3free

link01_projectlink01Match1.0.0free

pkobo-news01_projectpkobo-news01Range≤1.0.3free

pkobo-vote01_projectpkobo-vote01Range≤1.0.1free

telop01_projecttelop01Match1.0.0free

CPENameOperatorVersion
calendar01_project:calendar01calendar01 project calendar01eq1.0.0
calendar02_project:calendar02calendar02 project calendar02eq1.0.0
calendarform01_project:calendarform01calendarform01 project calendarform01le1.0.3
gallery01_project:gallery01gallery01 project gallery01le1.0.3
link01_project:link01link01 project link01eq1.0.0
pkobo-news01_project:pkobo-news01pkobo-news01 project pkobo-news01le1.0.3
pkobo-vote01_project:pkobo-vote01pkobo-vote01 project pkobo-vote01le1.0.1
telop01_project:telop01telop01 project telop01eq1.0.0

CPE	Name	Operator	Version
calendar01_project:calendar01	calendar01 project calendar01	eq	1.0.0
calendar02_project:calendar02	calendar02 project calendar02	eq	1.0.0
calendarform01_project:calendarform01	calendarform01 project calendarform01	le	1.0.3
gallery01_project:gallery01	gallery01 project gallery01	le	1.0.3
link01_project:link01	link01 project link01	eq	1.0.0
pkobo-news01_project:pkobo-news01	pkobo-news01 project pkobo-news01	le	1.0.3
pkobo-vote01_project:pkobo-vote01	pkobo-vote01 project pkobo-vote01	le	1.0.1
telop01_project:telop01	telop01 project telop01	eq	1.0.0

CNA Affected

[
  {
    "product": "[Calendar01], [Calendar02], [PKOBO-News01], [PKOBO-vote01], [Telop01], [Gallery01], [CalendarForm01], and [Link01]",
    "vendor": "PHP Factory",
    "versions": [
      {
        "status": "affected",
        "version": "[Calendar01] free edition ver1.0.0, [Calendar02] free edition ver1.0.0, [PKOBO-News01] free edition ver1.0.3 and earlier, [PKOBO-vote01] free edition ver1.0.1 and earlier, [Telop01] free edition ver1.0.0, [Gallery01] free edition ver1.0.3 and earlier, [CalendarForm01] free edition ver1.0.3 and earlier, and [Link01] free edition ver1.0.0"
      }
    ]
  }
]

References

jvn.jp/en/jp/JVN73169744/index.html

www.php-factory.net/calendar/01.php

www.php-factory.net/calendar/02.php

www.php-factory.net/calendar_form/01.php

www.php-factory.net/gallery/01.php

www.php-factory.net/link/01.php

www.php-factory.net/news/pkobo-news01.php

www.php-factory.net/telop/01.php

www.php-factory.net/vote/01.php

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.071 Low

EPSS

Percentile

94.0%

JSON

Related for CVE-2020-5616

cvelist1 prion1 nvd1 jvn1