Search criteria
2 vulnerabilities found for ZenTao Pro by EasyCorp
CVE-2020-7361 (GCVE-0-2020-7361)
Vulnerability from cvelistv5 – Published: 2020-08-06 15:45 – Updated: 2024-09-16 22:01
VLAI?
Summary
The EasyCorp ZenTao Pro application suffers from an OS command injection vulnerability in its '/pro/repo-create.html' component. After authenticating to the ZenTao dashboard, attackers may construct and send arbitrary OS commands via the POST parameter 'path', and those commands will run in an elevated SYSTEM context on the underlying Windows operating system.
Severity ?
9.6 (Critical)
CWE
- CWE-78 - OS Command Injection
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| EasyCorp | ZenTao Pro |
Affected:
8.8.2 , ≤ 8.8.2
(custom)
|
Credits
This issue was discovered by Daniel Monzón.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T09:25:49.007Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/rapid7/metasploit-framework/pull/13828"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "ZenTao Pro",
"vendor": "EasyCorp",
"versions": [
{
"lessThanOrEqual": "8.8.2",
"status": "affected",
"version": "8.8.2",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was discovered by Daniel Monz\u00f3n."
}
],
"datePublic": "2020-07-08T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The EasyCorp ZenTao Pro application suffers from an OS command injection vulnerability in its \u0027/pro/repo-create.html\u0027 component. After authenticating to the ZenTao dashboard, attackers may construct and send arbitrary OS commands via the POST parameter \u0027path\u0027, and those commands will run in an elevated SYSTEM context on the underlying Windows operating system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-08-06T15:45:28",
"orgId": "9974b330-7714-4307-a722-5648477acda7",
"shortName": "rapid7"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rapid7/metasploit-framework/pull/13828"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ZenTao Pro Command Injection",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@rapid7.com",
"DATE_PUBLIC": "2020-07-08T19:28:00.000Z",
"ID": "CVE-2020-7361",
"STATE": "PUBLIC",
"TITLE": "ZenTao Pro Command Injection"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "ZenTao Pro",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "8.8.2",
"version_value": "8.8.2"
}
]
}
}
]
},
"vendor_name": "EasyCorp"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was discovered by Daniel Monz\u00f3n."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The EasyCorp ZenTao Pro application suffers from an OS command injection vulnerability in its \u0027/pro/repo-create.html\u0027 component. After authenticating to the ZenTao dashboard, attackers may construct and send arbitrary OS commands via the POST parameter \u0027path\u0027, and those commands will run in an elevated SYSTEM context on the underlying Windows operating system."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-78 OS Command Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/rapid7/metasploit-framework/pull/13828",
"refsource": "MISC",
"url": "https://github.com/rapid7/metasploit-framework/pull/13828"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9974b330-7714-4307-a722-5648477acda7",
"assignerShortName": "rapid7",
"cveId": "CVE-2020-7361",
"datePublished": "2020-08-06T15:45:28.912800Z",
"dateReserved": "2020-01-21T00:00:00",
"dateUpdated": "2024-09-16T22:01:33.434Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2020-7361 (GCVE-0-2020-7361)
Vulnerability from nvd – Published: 2020-08-06 15:45 – Updated: 2024-09-16 22:01
VLAI?
Summary
The EasyCorp ZenTao Pro application suffers from an OS command injection vulnerability in its '/pro/repo-create.html' component. After authenticating to the ZenTao dashboard, attackers may construct and send arbitrary OS commands via the POST parameter 'path', and those commands will run in an elevated SYSTEM context on the underlying Windows operating system.
Severity ?
9.6 (Critical)
CWE
- CWE-78 - OS Command Injection
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| EasyCorp | ZenTao Pro |
Affected:
8.8.2 , ≤ 8.8.2
(custom)
|
Credits
This issue was discovered by Daniel Monzón.
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T09:25:49.007Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/rapid7/metasploit-framework/pull/13828"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "ZenTao Pro",
"vendor": "EasyCorp",
"versions": [
{
"lessThanOrEqual": "8.8.2",
"status": "affected",
"version": "8.8.2",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "This issue was discovered by Daniel Monz\u00f3n."
}
],
"datePublic": "2020-07-08T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The EasyCorp ZenTao Pro application suffers from an OS command injection vulnerability in its \u0027/pro/repo-create.html\u0027 component. After authenticating to the ZenTao dashboard, attackers may construct and send arbitrary OS commands via the POST parameter \u0027path\u0027, and those commands will run in an elevated SYSTEM context on the underlying Windows operating system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-08-06T15:45:28",
"orgId": "9974b330-7714-4307-a722-5648477acda7",
"shortName": "rapid7"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/rapid7/metasploit-framework/pull/13828"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "ZenTao Pro Command Injection",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@rapid7.com",
"DATE_PUBLIC": "2020-07-08T19:28:00.000Z",
"ID": "CVE-2020-7361",
"STATE": "PUBLIC",
"TITLE": "ZenTao Pro Command Injection"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "ZenTao Pro",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "8.8.2",
"version_value": "8.8.2"
}
]
}
}
]
},
"vendor_name": "EasyCorp"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "This issue was discovered by Daniel Monz\u00f3n."
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The EasyCorp ZenTao Pro application suffers from an OS command injection vulnerability in its \u0027/pro/repo-create.html\u0027 component. After authenticating to the ZenTao dashboard, attackers may construct and send arbitrary OS commands via the POST parameter \u0027path\u0027, and those commands will run in an elevated SYSTEM context on the underlying Windows operating system."
}
]
},
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-78 OS Command Injection"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/rapid7/metasploit-framework/pull/13828",
"refsource": "MISC",
"url": "https://github.com/rapid7/metasploit-framework/pull/13828"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9974b330-7714-4307-a722-5648477acda7",
"assignerShortName": "rapid7",
"cveId": "CVE-2020-7361",
"datePublished": "2020-08-06T15:45:28.912800Z",
"dateReserved": "2020-01-21T00:00:00",
"dateUpdated": "2024-09-16T22:01:33.434Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}