high7.8Public exploit code
CVE-2020-12608
An issue was discovered in SolarWinds MSP PME (Patch Management Engine) Cache Service before 1.1.15 in the Advanced Monitoring Agent.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- SolarWinds MSP PME Cache Service 1.1.14 - Insecure File Permissions2020-05-11 · local · windows
Impact
An issue was discovered in SolarWinds MSP PME (Patch Management Engine) Cache Service before 1.1.15 in the Advanced Monitoring Agent. There are insecure file permissions for %PROGRAMDATA%\SolarWinds MSP\SolarWinds.MSP.CacheService\config\. This can lead to code execution by changing the CacheService.xml SISServerURL parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Solarwinds | Managed Service Provider Patch Management Engine | before 1.1.15 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/157591/SolarWinds-MSP-PME-Cache-Service-Insecure-File-Permissions-Code-Execution.html
- http://seclists.org/fulldisclosure/2020/May/23
- https://github.com/jensregel/Advisories/tree/master/CVE-2020-12608
- http://packetstormsecurity.com/files/157591/SolarWinds-MSP-PME-Cache-Service-Insecure-File-Permissions-Code-Execution.html
- http://seclists.org/fulldisclosure/2020/May/23
- https://github.com/jensregel/Advisories/tree/master/CVE-2020-12608