CVE-2020-5632
Estado: ModificadaAlta (7.8)—
InfoCage SiteShell series (Host type SiteShell for IIS V1.4, V1.5, and V1.6, Host type SiteShell for IIS prior to revision V2.0.0.6, V2.1.0.7, V2.1.1.6, V3.0.0.11, V4.0.0.6, V4.1.0.5, and V4.2.0.1, Host type SiteShell for Apache Windows V1.4, V1.5, and V1.6, and Host type SiteShell for Apache Windows prior to revision V2.0.0.6, V2.1.0.7, V2.1.1.6, V3.0.0.11, V4.0.0.6, V4.1.0.5, and V4.2.0.1) allow authenticated attackers to bypass access restriction and to execute arbitrary code with an elevated privilege via a specially crafted executable files.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 7.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.40%
- Percentil entre todas las CVEs puntuadas: 32
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- NVD-CWE-noinfo
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2020-5632",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 7.2,
"accessVector": "LOCAL",
"vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 3.9,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "vultures@jpcert.or.jp",
"affectedData": [
{
"vendor": "NEC Corporation",
"product": "InfoCage SiteShell series",
"versions": [
{
"status": "affected",
"version": "Host type SiteShell for IIS V1.4, V1.5, and V1.6, Host type SiteShell for IIS prior to revision V2.0.0.6, V2.1.0.7, V2.1.1.6, V3.0.0.11, V4.0.0.6, V4.1.0.5, and V4.2.0.1, Host type SiteShell for Apache Windows V1.4, V1.5, and V1.6, and Host type SiteShell for Apache Windows prior to revision V2.0.0.6, V2.1.0.7, V2.1.1.6, V3.0.0.11, V4.0.0.6, V4.1.0.5, and V4.2.0.1"
}
]
}
]
}
],
"published": "2020-10-06T06:15:12.590",
"references": [
{
"url": "https://jpn.nec.com/infocage/siteshell/everyone_20200918.html",
"tags": [
"Vendor Advisory"
],
"source": "vultures@jpcert.or.jp"
},
{
"url": "https://jvn.jp/en/jp/JVN07426151/index.html",
"tags": [
"Third Party Advisory"
],
"source": "vultures@jpcert.or.jp"
},
{
"url": "https://jpn.nec.com/infocage/siteshell/everyone_20200918.html",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://jvn.jp/en/jp/JVN07426151/index.html",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "InfoCage SiteShell series (Host type SiteShell for IIS V1.4, V1.5, and V1.6, Host type SiteShell for IIS prior to revision V2.0.0.6, V2.1.0.7, V2.1.1.6, V3.0.0.11, V4.0.0.6, V4.1.0.5, and V4.2.0.1, Host type SiteShell for Apache Windows V1.4, V1.5, and V1.6, and Host type SiteShell for Apache Windows prior to revision V2.0.0.6, V2.1.0.7, V2.1.1.6, V3.0.0.11, V4.0.0.6, V4.1.0.5, and V4.2.0.1) allow authenticated attackers to bypass access restriction and to execute arbitrary code with an elevated privilege via a specially crafted executable files."
},
{
"lang": "es",
"value": "Serie InfoCage SiteShell (Host type SiteShell para IIS V1.4, V1.5 y V1.6, tipo de Host SiteShell para IIS versiones anteriores a V2.0.0.6, V2.1.0.7, V2.1.1.6, V3. 0.0.11, V4.0.0.6, V4.1.0.5 y V4.2.0.1, tipo de host SiteShell para Apache Windows V1.4, V1.5 y V1.6, y tipo de host SiteShell para Apache Windows anterior a revisión V2.0.0.6, V2.1.0.7, V2.1.1.6, V3.0.0.11, V4.0.0.6, V4.1.0.5 y V4.2.0.1), permiten a atacantes autenticados omitir una restricción de acceso y ejecutar código arbitrario con un privilegio elevado por medio de archivos ejecutables especialmente diseñados"
}
],
"lastModified": "2026-06-17T03:21:43.540",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:nec:infocage_siteshell:*:*:*:*:*:apache_windows:*:*",
"vulnerable": true,
"matchCriteriaId": "1102AE7F-8BAD-46EE-A63B-CD3A6F76AEF2",
"versionEndExcluding": "2.0.0.6"
},
{
"criteria": "cpe:2.3:a:nec:infocage_siteshell:*:*:*:*:*:iis:*:*",
"vulnerable": true,
"matchCriteriaId": "AB44835D-644F-48E7-B470-C8BDAAAA1400",
"versionEndExcluding": "2.0.0.6",
"versionStartIncluding": "2.0.0.0"
},
{
"criteria": "cpe:2.3:a:nec:infocage_siteshell:*:*:*:*:*:apache_windows:*:*",
"vulnerable": true,
"matchCriteriaId": "943B17B1-83F1-409E-B240-5244C4BD1FA4",
"versionEndExcluding": "2.1.0.7",
"versionStartIncluding": "2.1.0.0"
},
{
"criteria": "cpe:2.3:a:nec:infocage_siteshell:*:*:*:*:*:iis:*:*",
"vulnerable": true,
"matchCriteriaId": "243A65F2-0E6F-42F2-9BB1-8BDA62360210",
"versionEndExcluding": "2.1.0.7",
"versionStartIncluding": "2.1.0.0"
},
{
"criteria": "cpe:2.3:a:nec:infocage_siteshell:*:*:*:*:*:apache_windows:*:*",
"vulnerable": true,
"matchCriteriaId": "88AFF309-FA58-4A56-B298-8B6D10D572B6",
"versionEndExcluding": "2.1.1.6",
"versionStartIncluding": "2.1.1.0"
},
{
"criteria": "cpe:2.3:a:nec:infocage_siteshell:*:*:*:*:*:iis:*:*",
"vulnerable": true,
"matchCriteriaId": "2DE19748-10F6-4F43-89DF-1BF0D67ADF60",
"versionEndExcluding": "2.1.1.6",
"versionStartIncluding": "2.1.1.0"
},
{
"criteria": "cpe:2.3:a:nec:infocage_siteshell:*:*:*:*:*:apache_windows:*:*",
"vulnerable": true,
"matchCriteriaId": "78D1AD15-007A-4072-8314-F027EE77EC60",
"versionEndExcluding": "3.0.0.11",
"versionStartIncluding": "3.0.0.0"
},
{
"criteria": "cpe:2.3:a:nec:infocage_siteshell:*:*:*:*:*:iis:*:*",
"vulnerable": true,
"matchCriteriaId": "499B8143-FB63-43BA-8CAE-DDA2EA156B17",
"versionEndExcluding": "3.0.0.11",
"versionStartIncluding": "3.0.0.0"
},
{
"criteria": "cpe:2.3:a:nec:infocage_siteshell:*:*:*:*:*:apache_windows:*:*",
"vulnerable": true,
"matchCriteriaId": "E14AE3AD-CDAB-410E-A0BC-D6C02577645E",
"versionEndExcluding": "4.0.0.6",
"versionStartIncluding": "4.0.0.0"
},
{
"criteria": "cpe:2.3:a:nec:infocage_siteshell:*:*:*:*:*:iis:*:*",
"vulnerable": true,
"matchCriteriaId": "53B2AD2C-7A4F-4269-856E-4A0EC13B4D82",
"versionEndExcluding": "4.0.0.6",
"versionStartIncluding": "4.0.0.0"
},
{
"criteria": "cpe:2.3:a:nec:infocage_siteshell:*:*:*:*:*:apache_windows:*:*",
"vulnerable": true,
"matchCriteriaId": "F511AC4B-A4A3-4CA9-961B-B176807D8740",
"versionEndExcluding": "4.1.0.5",
"versionStartIncluding": "4.1.0.0"
},
{
"criteria": "cpe:2.3:a:nec:infocage_siteshell:*:*:*:*:*:iis:*:*",
"vulnerable": true,
"matchCriteriaId": "9D0CF31F-FADA-4676-88E3-D3F0FD604696",
"versionEndExcluding": "4.1.0.5",
"versionStartIncluding": "4.1.0.0"
},
{
"criteria": "cpe:2.3:a:nec:infocage_siteshell:*:*:*:*:*:apache_windows:*:*",
"vulnerable": true,
"matchCriteriaId": "54135531-1626-4A9A-821E-EB42D969A56A",
"versionEndExcluding": "4.2.0.1",
"versionStartIncluding": "4.2.0.0"
},
{
"criteria": "cpe:2.3:a:nec:infocage_siteshell:*:*:*:*:*:iis:*:*",
"vulnerable": true,
"matchCriteriaId": "77D31629-16BB-4ED7-9030-131B03508FFB",
"versionEndExcluding": "4.2.0.1",
"versionStartIncluding": "4.2.0.0"
},
{
"criteria": "cpe:2.3:a:nec:infocage_siteshell:1.4:*:*:*:*:apache_windows:*:*",
"vulnerable": true,
"matchCriteriaId": "310372EF-3CD0-4482-B749-35DB81E49889"
},
{
"criteria": "cpe:2.3:a:nec:infocage_siteshell:1.4:*:*:*:*:iis:*:*",
"vulnerable": true,
"matchCriteriaId": "3D29154E-D3E5-4259-BB87-60DF549316D7"
},
{
"criteria": "cpe:2.3:a:nec:infocage_siteshell:1.5:*:*:*:*:apache_windows:*:*",
"vulnerable": true,
"matchCriteriaId": "52D24DA5-451B-4155-A05C-895B7E291DAB"
},
{
"criteria": "cpe:2.3:a:nec:infocage_siteshell:1.5:*:*:*:*:iis:*:*",
"vulnerable": true,
"matchCriteriaId": "E26E05E8-8098-42C5-82E8-57031EA862B6"
},
{
"criteria": "cpe:2.3:a:nec:infocage_siteshell:1.6:*:*:*:*:apache_windows:*:*",
"vulnerable": true,
"matchCriteriaId": "5ED5F3A2-2680-4BC0-B02D-448225FF4344"
},
{
"criteria": "cpe:2.3:a:nec:infocage_siteshell:1.6:*:*:*:*:iis:*:*",
"vulnerable": true,
"matchCriteriaId": "DD7C274C-2FE3-43D9-8D8D-DE0D72F67771"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "vultures@jpcert.or.jp"
}