CVE-2020-5632 Privilege escalation in InfoCage SiteShell series
Authenticated attackers can bypass access restrictions and execute arbitrary code with elevated privileges in NEC InfoCage SiteShell.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-5632?
CVE-2020-5632 is a high-severity vulnerability in NEC Corporation InfoCage SiteShell series, published on 6 Oct 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
InfoCage SiteShell series (Host type SiteShell for IIS V1.4, V1.5, and V1.6, Host type SiteShell for IIS prior to revision V2.0.0.6, V2.1.0.7, V2.1.1.6, V3.0.0.11, V4.0.0.6, V4.1.0.5, and V4.2.0.1, Host type SiteShell for Apache Windows V1.4, V1.5, and V1.6, and Host type SiteShell for Apache Windows prior to revision V2.0.0.6, V2.1.0.7, V2.1.1.6, V3.0.0.11, V4.0.0.6, V4.1.0.5, and V4.2.0.1) allow authenticated attackers to bypass access restriction and to execute arbitrary code with an elevated privilege via a specially crafted executable files.
Which versions are affected by CVE-2020-5632?
It affects 1 product.
Products include Nec Infocage Siteshell.
How do I fix CVE-2020-5632?
No fix has been published for CVE-2020-5632 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-5632 being exploited?
There is no known exploitation of CVE-2020-5632 in the wild and no public exploit code.
Sources
Also known as GHSA-4p3x-6hj6-j849.