CVE-2020-5632
High
Description
InfoCage SiteShell series (Host type SiteShell for IIS V1.4, V1.5, and V1.6, Host type SiteShell for IIS prior to revision V2.0.0.6, V2.1.0.7, V2.1.1.6, V3.0.0.11, V4.0.0.6, V4.1.0.5, and V4.2.0.1, Host type SiteShell for Apache Windows V1.4, V1.5, and V1.6, and Host type SiteShell for Apache Windows prior to revision V2.0.0.6, V2.1.0.7, V2.1.1.6, V3.0.0.11, V4.0.0.6, V4.1.0.5, and V4.2.0.1) allow authenticated attackers to bypass access restriction and to execute arbitrary code with an elevated privilege via a specially crafted executable files.
SeverityHigh
CVSS7.8
Exploit probability—
ProductNec Infocage Siteshell
PublishedOct 6, 2020
First seenOct 6, 2020
How to fix
Update
- nec infocage_siteshell2.0.0.6, 2.1.0.7, 2.1.1.6, 3.0.0.11, 4.0.0.6, 4.1.0.5, 4.2.0.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nec infocage_siteshell | v < 2.0.0.6, 2.0.0.0 ≤ v < 2.0.0.6, 2.1.0.0 ≤ v < 2.1.0.7, 2.1.1.0 ≤ v < 2.1.1.6, 3.0.0.0 ≤ v < 3.0.0.11, 4.0.0.0 ≤ v < 4.0.0.6, 4.1.0.0 ≤ v < 4.1.0.5, 4.2.0.0 ≤ v < 4.2.0.1, 1.4, 1.5, 1.6 | 2.0.0.6, 2.1.0.7, 2.1.1.6, 3.0.0.11, 4.0.0.6, 4.1.0.5, 4.2.0.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.