Real-Time (RT) 6.0 Multiple Vulnerabilities Advisory: RCE, XSS, SQLi, CVE-2020-4221-27

Vulnerability Overview Multiple security vulnerabilities exist in RT version 6.0.3, primarily involving privilege escalation, information disclosure, SQL injection, LDAP authentication bypass, Cross-Site Request Forgery (CSRF), Stored Cross-Site Scripting (XSS), and Reflected Cross-Site Scripting (XSS). Impact Scope Privilege Escalation and Information Disclosure: RT version 6.0 contains privilege escalation and information disclosure vulnerabilities. Attackers can exploit the privileged user collection endpoint to obtain authentication credentials of other users and read data. SQL Injection: RT version 6.0 contains an SQL injection vulnerability. Attackers can execute arbitrary SQL queries by inputting malicious parameters. LDAP Authentication Bypass: RT version 6.0 contains an LDAP authentication bypass vulnerability. Attackers can bypass authentication against LDAP or Active Directory servers. Cross-Site Request Forgery (CSRF): RT version 6.0 contains a CSRF vulnerability. Attackers can induce logged-in users to perform unintended actions. Stored Cross-Site Scripting (XSS): RT version 6.0 contains a stored XSS vulnerability. Attackers can inject malicious scripts through templates. Reflected Cross-Site Scripting (XSS): RT version 6.0 contains a reflected XSS vulnerability. Attackers can inject malicious scripts via search page URL parameters. CSV/Formula Injection: RT version 6.0 contains a CSV/formula injection vulnerability. Attackers can execute malicious code by uploading files. Remediation Privilege Escalation and Information Disclosure: It is recommended to upgrade to RT version 6.0.3, which has fixed this vulnerability. SQL Injection: It is recommended to upgrade to RT version 6.0.3, which has fixed this vulnerability. LDAP Authentication Bypass: It is recommended to upgrade to RT version 6.0.3, which has fixed this vulnerability. Cross-Site Request Forgery (CSRF): It is recommended to upgrade to RT version 6.0.3, which has fixed this vulnerability. Stored Cross-Site Scripting (XSS): It is recommended to upgrade to RT version 6.0.3, which has fixed this vulnerability. Reflected Cross-Site Scripting (XSS): It is recommended to upgrade to RT version 6.0.3, which has fixed this vulnerability. CSV/Formula Injection: It is recommended to upgrade to RT version 6.0.3, which has fixed this vulnerability. Specific Vulnerability Details 1. Privilege Escalation and Information Disclosure - Vulnerability ID: CVE-2020-4221 - Description: RT version 6.0 contains privilege escalation and information disclosure vulnerabilities. Attackers can exploit the privileged user collection endpoint to obtain authentication credentials of other users and read data. - Remediation: Upgrade to RT version 6.0.3. 2. SQL Injection - Vulnerability ID: CVE-2020-4222 - Description: RT version 6.0 contains an SQL injection vulnerability. Attackers can execute arbitrary SQL queries by inputting malicious parameters. - Remediation: Upgrade to RT version 6.0.3. 3. LDAP Authentication Bypass - Vulnerability ID: CVE-2020-4223 - Description: RT version 6.0 contains an LDAP authentication bypass vulnerability. Attackers can bypass authentication against LDAP or Active Directory servers. - Remediation: Upgrade to RT version 6.0.3. 4. Cross-Site Request Forgery (CSRF) - Vulnerability ID: CVE-2020-4224 - Description: RT version 6.0 contains a CSRF vulnerability. Attackers can induce logged-in users to perform unintended actions. - Remediation: Upgrade to RT version 6.0.3. 5. Stored Cross-Site Scripting (XSS) - Vulnerability ID: CVE-2020-4225 - Description: RT version 6.0 contains a stored XSS vulnerability. Attackers can inject malicious scripts through templates. - Remediation: Upgrade to RT version 6.0.3. 6. Reflected Cross-Site Scripting (XSS) - Vulnerability ID: CVE-2020-4226 - Description: RT version 6.0 contains a reflected XSS vulnerability. Attackers can inject malicious scripts via search page URL parameters. - Remediation: Upgrade to RT version 6.0.3. 7. CSV/Formula Injection - Vulnerability ID: CVE-2020-4227 - Description: RT version 6.0 contains a CSV/formula injection vulnerability. Attackers can execute malicious code by uploading files. - Remediation: Upgrade to RT version 6.0.3. Summary RT version 6.0.3 has fixed all the above security vulnerabilities. It is recommended to upgrade to this version as soon as possible to ensure system security.

Goal Reached Thanks to every supporter — we hit 100%!

Real-Time (RT) 6.0 Multiple Vulnerabilities Advisory: RCE, XSS, SQLi, CVE-2020-4221-27