Details of VAR-202006-0499

ID

VAR-202006-0499

CVE

CVE-2020-13866

TITLE

WinGate Vulnerability regarding improper default permissions in

Trust: 0.8

sources: JVNDB: JVNDB-2020-006303

DESCRIPTION

WinGate v9.4.1.5998 has insecure permissions for the installation directory, which allows local users to gain privileges by replacing an executable file with a Trojan horse. WinGate There is a vulnerability in improper default permissions.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be put into a state. Qbik IP Management WinGate is an integrated multi-protocol proxy server for New Zealand Qbik IP Management. The product also supports functions such as e-mail servers and Internet gateways. Qbik IP Management WinGate version 9.4.1.5998 has a security vulnerability, which is caused by the program assigning unsafe permissions to the installation directory. Local attackers can use this vulnerability to gain permission

Trust: 2.16

sources: NVD: CVE-2020-13866 // JVNDB: JVNDB-2020-006303 // CNVD: CNVD-2020-36616

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2020-36616

AFFECTED PRODUCTS

vendor:	qbik	model:	wingate	scope:	eq	version:	9.4.1.5998	Trust: 1.8
vendor:	qbik	model:	ip management wingate	scope:	eq	version:	9.4.1.5998	Trust: 0.6

sources: CNVD: CNVD-2020-36616 // JVNDB: JVNDB-2020-006303 // NVD: CVE-2020-13866

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-13866
value:	HIGH
Trust: 1.0
NVD:	JVNDB-2020-006303
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2020-36616
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-202006-568
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2020-13866
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0
NVD:	JVNDB-2020-006303
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	NONE
impactScore:	NONE
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.8
CNVD:	CNVD-2020-36616
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2020-13866
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	JVNDB-2020-006303
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2020-36616 // JVNDB: JVNDB-2020-006303 // CNNVD: CNNVD-202006-568 // NVD: CVE-2020-13866

PROBLEMTYPE DATA

problemtype:	CWE-732	Trust: 1.0
problemtype:	CWE-276	Trust: 0.8

sources: JVNDB: JVNDB-2020-006303 // NVD: CVE-2020-13866

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202006-568

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202006-568

CONFIGURATIONS

sources: JVNDB: JVNDB-2020-006303

PATCH

title:

Top Page

url:

https://www.wingate.com/

Trust: 0.8

sources: JVNDB: JVNDB-2020-006303

EXTERNAL IDS

db:	PACKETSTORM	id:	157958	Trust: 3.0
db:	NVD	id:	CVE-2020-13866	Trust: 3.0
db:	JVNDB	id:	JVNDB-2020-006303	Trust: 0.8
db:	CNVD	id:	CNVD-2020-36616	Trust: 0.6
db:	NSFOCUS	id:	47335	Trust: 0.6
db:	EXPLOIT-DB	id:	48573	Trust: 0.6
db:	CNNVD	id:	CNNVD-202006-568	Trust: 0.6

sources: CNVD: CNVD-2020-36616 // JVNDB: JVNDB-2020-006303 // CNNVD: CNNVD-202006-568 // NVD: CVE-2020-13866

REFERENCES

url:	http://packetstormsecurity.com/files/157958/wingate-9.4.1.5998-insecure-permissions-privilege-escalation.html	Trust: 3.6
url:	http://seclists.org/fulldisclosure/2020/jun/11	Trust: 1.6
url:	http://hyp3rlinx.altervista.org/advisories/wingate-insecure-permissions-local-privilege-escalation.txt	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2020-13866	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-13866	Trust: 0.8
url:	https://www.exploit-db.com/exploits/48573	Trust: 0.6
url:	http://www.nsfocus.net/vulndb/47335	Trust: 0.6

sources: CNVD: CNVD-2020-36616 // JVNDB: JVNDB-2020-006303 // CNNVD: CNNVD-202006-568 // NVD: CVE-2020-13866

CREDITS

hyp3rlinx

Trust: 0.6

sources: CNNVD: CNNVD-202006-568

SOURCES

db:	CNVD	id:	CNVD-2020-36616
db:	JVNDB	id:	JVNDB-2020-006303
db:	CNNVD	id:	CNNVD-202006-568
db:	NVD	id:	CVE-2020-13866

LAST UPDATE DATE

2024-11-23T23:04:19.751000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2020-36616	date:	2020-07-07T00:00:00
db:	JVNDB	id:	JVNDB-2020-006303	date:	2020-07-07T00:00:00
db:	CNNVD	id:	CNNVD-202006-568	date:	2020-07-30T00:00:00
db:	NVD	id:	CVE-2020-13866	date:	2024-11-21T05:02:02.277

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2020-36616	date:	2020-07-07T00:00:00
db:	JVNDB	id:	JVNDB-2020-006303	date:	2020-07-07T00:00:00
db:	CNNVD	id:	CNNVD-202006-568	date:	2020-06-05T00:00:00
db:	NVD	id:	CVE-2020-13866	date:	2020-06-08T16:15:10.117