CVE-2020-11847

Published: Aug 21, 2024Modified: Aug 23, 2024

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

SSH authenticated user when access the PAM server can execute an OS command to gain the full system access using bash. This issue affects Privileged Access Manager before 3.7.0.1.

Affected (2)

Products: Microfocus: Netiq Privileged Access Manager

Microfocus

1 product

Netiq Privileged Access Manager

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Microfocus Netiq Privileged Access Manager	Before 3.7
Microfocus Netiq Privileged Access Manager	Version 3.7

Related CWEs

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

References (1)

https://www.netiq.com/documentation/privileged-account-manager-37/npam_3701_releasenotes/data/npam_3701_releasenotes.html

Source: security@opentext.com

Release Notes

Timeline

No history available yet.