CVE-2020-15397
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
iFAX Solutions HylaFAX+是美国iFAX Solutions公司的一套开源的企业级发送和接收传真系统。该系统为局域网中的用户提供传真功能。HylaFAX Enterprise是商业版本。 iFAX Solutions HylaFAX+ 7.0.2及之前版本和HylaFAX Enterprise中存在安全漏洞。攻击者可利用该漏洞在调用二进制文件的用户上下文中执行代码。
Possible ATT&CK Techniques 1 AI
T1068 · Exploitation for Privilege Escalation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2020-15397
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
HylaFAX+ through 7.0.2 and HylaFAX Enterprise have scripts that execute binaries from directories writable by unprivileged users (e.g., locations under /var/spool/hylafax that are writable by the uucp account). This allows these users to execute code in the context of the user calling these binaries (often root).
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
iFAX Solutions HylaFAX+和HylaFAX Enterprise 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
iFAX Solutions HylaFAX+是美国iFAX Solutions公司的一套开源的企业级发送和接收传真系统。该系统为局域网中的用户提供传真功能。HylaFAX Enterprise是商业版本。 iFAX Solutions HylaFAX+ 7.0.2及之前版本和HylaFAX Enterprise中存在安全漏洞。攻击者可利用该漏洞在调用二进制文件的用户上下文中执行代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2020-15397
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-15397
请登录查看更多情报信息。
Vendor Advisories for CVE-2020-15397 (2)
-
https://bugzilla.suse.com/show_bug.cgi?id=1173519 x_refsource_MISC
-
Mailing List Discussions for CVE-2020-15397 (6)
-
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00054.html vendor-advisory x_refsource_SUSE
-
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00039.html vendor-advisory x_refsource_SUSE
-
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00046.html vendor-advisory x_refsource_SUSE
-
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00040.html vendor-advisory x_refsource_SUSE
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J52QFVREJWJ35YSEEDDRMZQ2LM2H2WE6/ vendor-advisory x_refsource_FEDORA
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Y46FOVJUS5SO44A2VEKR7DXEHTI4WK5L/ vendor-advisory x_refsource_FEDORA
Other References for CVE-2020-15397 (1)
-
https://sourceforge.net/p/hylafax/HylaFAX+/2534/ x_refsource_MISC
Same Patch Batch · n/a · 2020-06-30 · 22 CVEs total
| CVE-2020-15049 | 9.9 CRITICAL | Squid 环境问题漏洞 |
| CVE-2020-14956 | Windows cleaning assistant 输入验证错误漏洞 | |
| CVE-2020-15395 | MediaArea MediaInfo 缓冲区错误漏洞 | |
| CVE-2017-18922 | LibVNCServer 缓冲区错误漏洞 | |
| CVE-2020-15396 | iFAX Solutions HylaFAX+和HylaFAX Enterprise 安全漏洞 | |
| CVE-2019-20893 | Activision Infinity Ward Call of Duty Modern Warfare 2 缓冲区错误漏洞 | |
| CVE-2020-15400 | CakePHP 跨站请求伪造漏洞 | |
| CVE-2020-15401 | IOBit Malware Fighter Pro 后置链接漏洞 | |
| CVE-2020-15411 | MISP 安全漏洞 | |
| CVE-2020-15412 | MISP 安全漏洞 | |
| CVE-2020-15415 | DrayTek Vigor3900、Vigor2960和Vigor300B 操作系统命令注入漏洞 | |
| CVE-2020-9483 | Apache SkyWalking SQL注入漏洞 | |
| CVE-2020-14947 | OCS Inventory NG 操作系统命令注入漏洞 | |
| CVE-2020-14957 | Windows cleaning assistant 输入验证错误漏洞 | |
| CVE-2020-13095 | Objective Development Software Little Snitch 后置链接漏洞 | |
| CVE-2020-14482 | Delta Electronics Industrial Automation DOPSoft 缓冲区错误漏洞 | |
| CVE-2020-15307 | Nozomi Networks Guardian 跨站脚本漏洞 | |
| CVE-2020-14474 | Cellebrite UFED 信任管理问题漏洞 | |
| CVE-2020-14059 | Squid 安全漏洞 | |
| CVE-2020-14058 | Squid 代码问题漏洞 |
Showing top 20 of 22 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2020-15397
No comments yet