CVE-2020-6020

Check Point Security Management's Internal CA web management before Jumbo HFAs R80.10 Take 278, R80.20 Take 160, R80.30 Take 210, and R80.40 Take 38, can be manipulated to run commands as a high privileged user or crash, due to weak input validation on inputs by a trusted management administrator.

CVSS v3.0 6.4 MEDIUM
CVSS v2.0 7.4 HIGH

6.4^/10

CVSS v3.0 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 5.5

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact LOW

Scope UNCHANGED

7.4^/10

CVSS v2.0 : HIGH

Vector : AV:A/AC:L/Au:S/C:C/I:C/A:P

Exploitability : 5.1 / Impact : 9.5

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact PARTIAL

References

Link	Resource
https://supportcontent.checkpoint.com/solutions?id=sk142952	Vendor Advisory

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:checkpoint:ica_management_portal:r80.20:-::::::
	cpe:2.3:a:checkpoint:ica_management_portal:r80.20:take_156::::::
	cpe:2.3:a:checkpoint:ica_management_portal::::::::

Configuration 2 (hide)

OR	cpe:2.3:a:checkpoint:ica_management_portal:r80.30:take_200::::::
	cpe:2.3:a:checkpoint:ica_management_portal:r80.30:-::::::
	cpe:2.3:a:checkpoint:ica_management_portal::::::::

Configuration 3 (hide)

OR	cpe:2.3:a:checkpoint:ica_management_portal:r80.40:-::::::
	cpe:2.3:a:checkpoint:ica_management_portal::::::::

Configuration 4 (hide)

OR	cpe:2.3:a:checkpoint:ica_management_portal::::::::
	cpe:2.3:a:checkpoint:ica_management_portal:r80.10:-::::::

Information

Published : 2020-09-24 07:15

Updated : 2022-11-16 05:56

NVD link : CVE-2020-6020

Mitre link : CVE-2020-6020

JSON object : View

CWE

CWE-20

Improper Input Validation

Advertisement

Products Affected

checkpoint

ica_management_portal

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://supportcontent.checkpoint.com/solutions?id=sk142952", "name": "https://supportcontent.checkpoint.com/solutions?id=sk142952", "tags": ["Vendor Advisory"], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Check Point Security Management's Internal CA web management before Jumbo HFAs R80.10 Take 278, R80.20 Take 160, R80.30 Take 210, and R80.40 Take 38, can be manipulated to run commands as a high privileged user or crash, due to weak input validation on inputs by a trusted management administrator."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-20"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2020-6020", "ASSIGNER": "cve@checkpoint.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.4, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:L/Au:S/C:C/I:C/A:P", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "acInsufInfo": false, "impactScore": 9.5, "obtainAllPrivilege": false, "exploitabilityScore": 5.1, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.5, "exploitabilityScore": 0.9}}, "publishedDate": "2020-09-24T14:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:checkpoint:ica_management_portal:r80.20:-:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:checkpoint:ica_management_portal:r80.20:take_156:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:checkpoint:ica_management_portal:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "r80.20"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:checkpoint:ica_management_portal:r80.30:take_200:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:checkpoint:ica_management_portal:r80.30:-:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:checkpoint:ica_management_portal:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "r80.30"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:checkpoint:ica_management_portal:r80.40:-:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:checkpoint:ica_management_portal:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "r80.40"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:checkpoint:ica_management_portal:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "r80.10"}, {"cpe23Uri": "cpe:2.3:a:checkpoint:ica_management_portal:r80.10:-:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-11-16T13:56Z"}