Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2020-13151

Quick assessment

Affected
n/a n/a
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Aerospike是美国Aerospike公司的一套NoSQL数据库解决方案。 Aerospike（社区版）4.9.0.5版本中存在安全漏洞。攻击者借助特制的UDF利用该漏洞以当前用户权限在该集群的所有节点上执行任意的操作系统命令。

AI Predicted 9.8 Difficulty: Easy EPSS 86.75% · P100

Public Exploits 2

ExploitDB · 1 EDB-49067 [remote]
Metasploit · 1 aerospike_database_udf_cmd_exec.rb [exploit]
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2020-13151

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions (UDFs), written in Lua, as part of a database query. It attempts to restrict code execution by disabling os.execute() calls, but this is insufficient. Anyone with network access can use a crafted UDF to execute arbitrary OS commands on all nodes of the cluster at the permission level of the user running the Aerospike service.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Aerospike 操作系统命令注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Aerospike是美国Aerospike公司的一套NoSQL数据库解决方案。 Aerospike（社区版）4.9.0.5版本中存在安全漏洞。攻击者借助特制的UDF利用该漏洞以当前用户权限在该集群的所有节点上执行任意的操作系统命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Shenlong Deep Dive — AI Deep Analysis

10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.

Read summary Full analysis (login)

Affected Products

Vendor Product Affected Versions CPE Subscribe
- n/a n/a -

II. Public POCs for CVE-2020-13151

# POC Description Source Link Shenlong Link
1 POC for CVE-2020-13151 https://github.com/b4ny4n/CVE-2020-13151 POC Details
2 None https://github.com/ByteMe1001/CVE-2020-13151-POC-Aerospike-Server-Host-Command-Execution-RCE- POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2020-13151

请登录查看更多情报信息。

Exploits & Public PoCs for CVE-2020-13151 (2)

Security Blog Posts for CVE-2020-13151 (1)

Other References for CVE-2020-13151 (3)

Same Patch Batch · n/a · 2020-08-05 · 12 CVEs total

CVE-2020-9036 Jeedom 跨站脚本漏洞
CVE-2020-17366 NLnet Labs Routinator 信任管理问题漏洞
CVE-2020-13404 ATOS/Sips community module 操作系统命令注入漏洞
CVE-2020-16254 Chartkick 注入漏洞
CVE-2020-16192 LimeSurvey 跨站脚本漏洞
CVE-2020-17364 User-Friendly SVN 跨站脚本漏洞
CVE-2020-16253 PgHero gem 跨站请求伪造漏洞
CVE-2020-16252 Field Test gem 跨站请求伪造漏洞
CVE-2020-13819 Extreme EAC Appliance 跨站脚本漏洞
CVE-2020-13921 Apache SkyWalking SQL注入漏洞
CVE-2020-17353 LilyPond 安全漏洞

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a

V. Comments for CVE-2020-13151

No comments yet

Leave a comment