CVE-2020-10569 File upload in n/a
Attackers can upload malicious files and execute commands via GhostCat chaining in SysAid On-Premise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-10569?
CVE-2020-10569 is a critical vulnerability in n/a, published on 21 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SysAid On-Premise 20.1.11, by default, allows the AJP protocol port, which is vulnerable to a GhostCat attack. Additionally, it allows unauthenticated access to upload files, which can be used to execute commands on the system by chaining it with a GhostCat attack. NOTE: This may be a duplicate of CVE-2020-1938
Weakness: CWE-434
Which versions are affected by CVE-2020-10569?
It affects 1 product.
Products include Sysaid On-Premise.
How do I fix CVE-2020-10569?
No fix has been published for CVE-2020-10569 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-10569 being exploited?
There is no known exploitation of CVE-2020-10569 in the wild and no public exploit code.
Sources
Also known as GHSA-66pv-97pv-f4qx.