CVE-2020-17504 (GCVE-0-2020-17504)

Vulnerability from cvelistv5 – Published: 2021-01-08 17:19 – Updated: 2024-08-04 14:00
VLAI
Summary
The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in ngpsystemcmd.php in which the http parameters "x_modules" and "y_modules" are not properly handled. The NDN-210 is part of Barco TransForm N solution and this vulnerability is patched from TransForm N version 3.8 onwards.
Severity
7.2 (High)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T14:00:48.658Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.barco.com/en/support/transform-n-management-server"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.barco.com/en/support/cms"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.barco.com/en/support/knowledge-base/kb11589"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in ngpsystemcmd.php in which the http parameters \"x_modules\" and \"y_modules\" are not properly handled. The NDN-210 is part of Barco TransForm N solution and this vulnerability is patched from TransForm N version 3.8 onwards."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-08T17:19:23.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.barco.com/en/support/transform-n-management-server"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.barco.com/en/support/cms"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.barco.com/en/support/knowledge-base/kb11589"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-17504",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in ngpsystemcmd.php in which the http parameters \"x_modules\" and \"y_modules\" are not properly handled. The NDN-210 is part of Barco TransForm N solution and this vulnerability is patched from TransForm N version 3.8 onwards."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.barco.com/en/support/transform-n-management-server",
              "refsource": "MISC",
              "url": "https://www.barco.com/en/support/transform-n-management-server"
            },
            {
              "name": "https://www.barco.com/en/support/cms",
              "refsource": "MISC",
              "url": "https://www.barco.com/en/support/cms"
            },
            {
              "name": "https://www.barco.com/en/support/knowledge-base/kb11589",
              "refsource": "CONFIRM",
              "url": "https://www.barco.com/en/support/knowledge-base/kb11589"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-17504",
    "datePublished": "2021-01-08T17:19:24.000Z",
    "dateReserved": "2020-08-12T00:00:00.000Z",
    "dateUpdated": "2024-08-04T14:00:48.658Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2020-17504",
      "date": "2026-10-06",
      "epss": "0.02971",
      "percentile": "0.86813"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:barco:transform_n:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "094B6FC0-DA52-4C94-8992-13522E60090C",
                  "versionEndExcluding": "3.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            },
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:h:barco:transform_ndn-210_lite:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "2BD8D359-AD98-4C2E-BBB6-16E4D00C9FA8",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:h:barco:transform_ndn-210_pro:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "44DD99C7-46AC-43FF-86AB-0B4CC222C902",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:h:barco:transform_ndn-211_lite:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "E8BF9D72-7D56-4E72-A66C-62D4232C57B6",
                  "vulnerable": false
                },
                {
                  "criteria": "cpe:2.3:h:barco:transform_ndn-211_pro:-:*:*:*:*:*:*:*",
                  "matchCriteriaId": "C9F7E77D-CCD3-4FF6-8D5E-0F745136B339",
                  "vulnerable": false
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in ngpsystemcmd.php in which the http parameters \"x_modules\" and \"y_modules\" are not properly handled. The NDN-210 is part of Barco TransForm N solution and this vulnerability is patched from TransForm N version 3.8 onwards."
        },
        {
          "lang": "es",
          "value": "El NDN-210 presenta un panel de administraci\u00f3n web que est\u00e1 disponible por medio de https.\u0026#xa0;Se presenta un problema de inyecci\u00f3n de comando que permitir\u00e1 a usuarios autenticados en el panel de administraci\u00f3n llevar a cabo una ejecuci\u00f3n de c\u00f3digo remota autenticada.\u0026#xa0;Se presenta un problema en el archivo ngpsystemcmd.php en el que los par\u00e1metros http \"x_modules\" y \"y_modules\" no son manejados apropiadamente.\u0026#xa0;El NDN-210 es parte de la soluci\u00f3n de Barco TransForm N y esta vulnerabilidad est\u00e1 parcheada a partir de TransForm N versi\u00f3n 3.8 en adelante"
        }
      ],
      "id": "CVE-2020-17504",
      "lastModified": "2024-11-21T05:08:14.570",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "MEDIUM",
            "cvssData": {
              "accessComplexity": "LOW",
              "accessVector": "NETWORK",
              "authentication": "SINGLE",
              "availabilityImpact": "PARTIAL",
              "baseScore": 6.5,
              "confidentialityImpact": "PARTIAL",
              "integrityImpact": "PARTIAL",
              "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
              "version": "2.0"
            },
            "exploitabilityScore": 8.0,
            "impactScore": 6.4,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": false
          }
        ],
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.2,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 1.2,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2021-01-08T18:15:13.137",
      "references": [
        {
          "source": "cve@mitre.org",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://www.barco.com/en/support/cms"
        },
        {
          "source": "cve@mitre.org",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://www.barco.com/en/support/knowledge-base/kb11589"
        },
        {
          "source": "cve@mitre.org",
          "tags": [
            "Product",
            "Vendor Advisory"
          ],
          "url": "https://www.barco.com/en/support/transform-n-management-server"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://www.barco.com/en/support/cms"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://www.barco.com/en/support/knowledge-base/kb11589"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Product",
            "Vendor Advisory"
          ],
          "url": "https://www.barco.com/en/support/transform-n-management-server"
        }
      ],
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-77"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:barco:transform_n:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "094B6FC0-DA52-4C94-8992-13522E60090C",
                    "versionEndExcluding": "3.8",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:h:barco:transform_ndn-210_lite:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2BD8D359-AD98-4C2E-BBB6-16E4D00C9FA8",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:barco:transform_ndn-210_pro:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "44DD99C7-46AC-43FF-86AB-0B4CC222C902",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:barco:transform_ndn-211_lite:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "E8BF9D72-7D56-4E72-A66C-62D4232C57B6",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:h:barco:transform_ndn-211_pro:-:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C9F7E77D-CCD3-4FF6-8D5E-0F745136B339",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in ngpsystemcmd.php in which the http parameters \"x_modules\" and \"y_modules\" are not properly handled. The NDN-210 is part of Barco TransForm N solution and this vulnerability is patched from TransForm N version 3.8 onwards."
          },
          {
            "lang": "es",
            "value": "El NDN-210 presenta un panel de administraci\u00f3n web que est\u00e1 disponible por medio de https.\u0026#xa0;Se presenta un problema de inyecci\u00f3n de comando que permitir\u00e1 a usuarios autenticados en el panel de administraci\u00f3n llevar a cabo una ejecuci\u00f3n de c\u00f3digo remota autenticada.\u0026#xa0;Se presenta un problema en el archivo ngpsystemcmd.php en el que los par\u00e1metros http \"x_modules\" y \"y_modules\" no son manejados apropiadamente.\u0026#xa0;El NDN-210 es parte de la soluci\u00f3n de Barco TransForm N y esta vulnerabilidad est\u00e1 parcheada a partir de TransForm N versi\u00f3n 3.8 en adelante"
          }
        ],
        "id": "CVE-2020-17504",
        "lastModified": "2024-11-21T05:08:14.570",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "SINGLE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 6.5,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 8.0,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.2,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2021-01-08T18:15:13.137",
        "references": [
          {
            "source": "cve@mitre.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.barco.com/en/support/cms"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.barco.com/en/support/knowledge-base/kb11589"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Product",
              "Vendor Advisory"
            ],
            "url": "https://www.barco.com/en/support/transform-n-management-server"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.barco.com/en/support/cms"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.barco.com/en/support/knowledge-base/kb11589"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Product",
              "Vendor Advisory"
            ],
            "url": "https://www.barco.com/en/support/transform-n-management-server"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-77"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.