« Volver al listado

CVE-2020-11431

Estado: ModificadaCrítica (9.1)—

The documentation component in i-net Clear Reports 16.0 to 19.2, HelpDesk 8.0 to 8.3, and PDFC 4.3 to 6.2 allows a remote unauthenticated attacker to read arbitrary system files and directories on the target server via Directory Traversal.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Inetsoftware — Clear ReportsInetsoftware — HelpdeskInetsoftware — Pdfc

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-11431",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-05-07T17:15:11.557",
  "references": [
    {
      "url": "https://www.inetsoftware.de/documentation/clear-reports/release-notes/releases/changes_19.2",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.inetsoftware.de/support/news/i-net-clear-reports-security-advisory-2020-apr-06",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.inetsoftware.de/support/news/i-net-helpdesk-sicherheitsankuendigung-2020-apr-06",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.inetsoftware.de/support/news/i-net-pdfc-security-advisory-2020-apr-06",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.inetsoftware.de/documentation/clear-reports/release-notes/releases/changes_19.2",
      "tags": [
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.inetsoftware.de/support/news/i-net-clear-reports-security-advisory-2020-apr-06",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.inetsoftware.de/support/news/i-net-helpdesk-sicherheitsankuendigung-2020-apr-06",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.inetsoftware.de/support/news/i-net-pdfc-security-advisory-2020-apr-06",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The documentation component in i-net Clear Reports 16.0 to 19.2, HelpDesk 8.0 to 8.3, and PDFC 4.3 to 6.2 allows a remote unauthenticated attacker to read arbitrary system files and directories on the target server via Directory Traversal."
    },
    {
      "lang": "es",
      "value": "El componente documentation en i-net Clear Reports versiones 16.0 hasta 19.2, HelpDesk versiones 8.0 hasta 8.3 y PDFC versiones 4.3 hasta 6.2, permite a un atacante remoto no autenticado leer archivos y directorios arbitrarios del sistema en el servidor objetivo por medio de un Salto de Directorio."
    }
  ],
  "lastModified": "2026-06-17T02:50:10.413",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:inetsoftware:clear_reports:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "69142902-81AD-4362-9A90-9896503231E3",
              "versionEndIncluding": "19.2",
              "versionStartIncluding": "16.0"
            },
            {
              "criteria": "cpe:2.3:a:inetsoftware:helpdesk:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4BC8FD58-A632-4EAD-AD2C-D6B182FC4BB4",
              "versionEndIncluding": "8.3",
              "versionStartIncluding": "8.0"
            },
            {
              "criteria": "cpe:2.3:a:inetsoftware:pdfc:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C14B54BF-F6A0-4209-B356-51DCA7A1B972",
              "versionEndIncluding": "6.2",
              "versionStartIncluding": "4.3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}