Details of VAR-202011-0134

ID

VAR-202011-0134

CVE

CVE-2020-12345

TITLE

Intel(R) Data Center Manager Console Vulnerability in improperly holding permissions in the installer

Trust: 0.8

sources: JVNDB: JVNDB-2020-013304

DESCRIPTION

Improper permissions in the installer for the Intel(R) Data Center Manager Console before version 3.6.2 may allow an authenticated user to potentially enable escalation of privilege via local access. Intel Data Center Manager SDK is a data center management SDK (Software Development Kit) of Intel Corporation. This product mainly provides real-time power supply and heat dissipation data of equipment

Trust: 1.71

sources: NVD: CVE-2020-12345 // JVNDB: JVNDB-2020-013304 // VULHUB: VHN-165014

AFFECTED PRODUCTS

vendor:	intel	model:	data center manager	scope:	lt	version:	3.6.2	Trust: 1.0
vendor:	インテル	model:	intel data center manager	scope:	eq	version:	3.6.2	Trust: 0.8
vendor:	インテル	model:	intel data center manager	scope:	eq	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2020-013304 // NVD: CVE-2020-12345

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-12345
value:	HIGH
Trust: 1.0
NVD:	CVE-2020-12345
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-202011-858
value:	HIGH
Trust: 0.6
VULHUB:	VHN-165014
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2020-12345
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-165014
severity:	MEDIUM
baseScore:	4.6
vectorString:	AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	3.9
impactScore:	6.4
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2020-12345
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2020-12345
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-165014 // JVNDB: JVNDB-2020-013304 // CNNVD: CNNVD-202011-858 // NVD: CVE-2020-12345

PROBLEMTYPE DATA

problemtype:	CWE-281	Trust: 1.1
problemtype:	Improper retention of permissions (CWE-281) [NVD Evaluation ]	Trust: 0.8

sources: VULHUB: VHN-165014 // JVNDB: JVNDB-2020-013304 // NVD: CVE-2020-12345

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202011-858

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202011-858

PATCH

title:

INTEL-SA-00430

url:

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00430.html

Trust: 0.8

sources: JVNDB: JVNDB-2020-013304

EXTERNAL IDS

db:	NVD	id:	CVE-2020-12345	Trust: 2.5
db:	JVNDB	id:	JVNDB-2020-013304	Trust: 0.8
db:	CNNVD	id:	CNNVD-202011-858	Trust: 0.7
db:	AUSCERT	id:	ESB-2020.3953	Trust: 0.6
db:	VULHUB	id:	VHN-165014	Trust: 0.1

sources: VULHUB: VHN-165014 // JVNDB: JVNDB-2020-013304 // CNNVD: CNNVD-202011-858 // NVD: CVE-2020-12345

REFERENCES

url:	https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00430	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2020-12345	Trust: 1.4
url:	https://www.auscert.org.au/bulletins/esb-2020.3953/	Trust: 0.6

sources: VULHUB: VHN-165014 // JVNDB: JVNDB-2020-013304 // CNNVD: CNNVD-202011-858 // NVD: CVE-2020-12345

SOURCES

db:	VULHUB	id:	VHN-165014
db:	JVNDB	id:	JVNDB-2020-013304
db:	CNNVD	id:	CNNVD-202011-858
db:	NVD	id:	CVE-2020-12345

LAST UPDATE DATE

2024-11-23T21:51:14.041000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-165014	date:	2020-11-20T00:00:00
db:	JVNDB	id:	JVNDB-2020-013304	date:	2021-06-23T08:06:00
db:	CNNVD	id:	CNNVD-202011-858	date:	2020-11-24T00:00:00
db:	NVD	id:	CVE-2020-12345	date:	2024-11-21T04:59:32.880

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-165014	date:	2020-11-12T00:00:00
db:	JVNDB	id:	JVNDB-2020-013304	date:	2021-06-23T00:00:00
db:	CNNVD	id:	CNNVD-202011-858	date:	2020-11-11T00:00:00
db:	NVD	id:	CVE-2020-12345	date:	2020-11-12T19:15:14.143