CVE-2020-36531 SevOne Network Management System Device Manager Page injection
Remote attackers can exploit an injection flaw in the Device Manager Page to escalate privileges and execute code on SevOne Network Management System.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-36531?
CVE-2020-36531 is a medium-severity code injection vulnerability in SevOne Network Management System, published on 3 Jun 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability, which was classified as critical, has been found in SevOne Network Management System up to 5.7.2.22. This issue affects the Device Manager Page. An injection leads to privilege escalation. The attack may be initiated remotely.
Which versions are affected by CVE-2020-36531?
It affects 1 product.
Products include Ibm Sevone Network Performance Management.
How do I fix CVE-2020-36531?
No fix has been published for CVE-2020-36531 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-36531 being exploited?
There is no known exploitation of CVE-2020-36531 in the wild and no public exploit code.
Other vulnerabilities in SevOne Network Management System
Sources
Also known as GHSA-wx87-pj46-74f6.