Sign-up

ID

VAR-202101-1140


CVE

CVE-2020-5147


TITLE

SonicWall NetExtender Windows  Unquoted search path or element vulnerability in client

Trust: 0.8

sources: JVNDB: JVNDB-2021-002450

DESCRIPTION

SonicWall NetExtender Windows client vulnerable to unquoted service path vulnerability, this allows a local attacker to gain elevated privileges in the host operating system. This vulnerability impact SonicWall NetExtender Windows client version 10.2.300 and earlier. Sonicwall NetExtender Windows client is an SSL VPN (Virtual Private Network) client application based on Windows platform of Sonicwall Company in the United States

Trust: 1.8

sources: NVD: CVE-2020-5147 // JVNDB: JVNDB-2021-002450 // VULHUB: VHN-183272 // VULMON: CVE-2020-5147

AFFECTED PRODUCTS

vendor:sonicwallmodel:netextenderscope:lteversion:10.2.300

Trust: 1.0

vendor:sonicwallmodel:netextenderscope:lteversion:10.2.300 and earlier

Trust: 0.8

vendor:sonicwallmodel:netextenderscope:eqversion: -

Trust: 0.8

sources: JVNDB: JVNDB-2021-002450 // NVD: CVE-2020-5147

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2020-5147
value: MEDIUM

Trust: 1.0

NVD: CVE-2020-5147
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-202101-435
value: MEDIUM

Trust: 0.6

VULHUB: VHN-183272
value: MEDIUM

Trust: 0.1

VULMON: CVE-2020-5147
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2020-5147
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-183272
severity: MEDIUM
baseScore: 4.6
vectorString: AV:L/AC:L/AU:N/C:P/I:P/A:P
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 3.9
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2020-5147
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 1.8
impactScore: 3.4
version: 3.1

Trust: 1.0

NVD: CVE-2020-5147
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-183272 // VULMON: CVE-2020-5147 // JVNDB: JVNDB-2021-002450 // CNNVD: CNNVD-202101-435 // NVD: CVE-2020-5147

PROBLEMTYPE DATA

problemtype:CWE-428

Trust: 1.1

problemtype:Unquoted search path or element (CWE-428) [NVD Evaluation ]

Trust: 0.8

sources: VULHUB: VHN-183272 // JVNDB: JVNDB-2021-002450 // NVD: CVE-2020-5147

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202101-435

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-202101-435

PATCH

title:SNWLID-2020-0023url:https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0023

Trust: 0.8

title:Sonicwall SonicWall NetExtender Windows client Fixes for code issue vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=139010

Trust: 0.6

sources: JVNDB: JVNDB-2021-002450 // CNNVD: CNNVD-202101-435

EXTERNAL IDS

db:PACKETSTORMid:163857

Trust: 2.6

db:NVDid:CVE-2020-5147

Trust: 2.6

db:JVNDBid:JVNDB-2021-002450

Trust: 0.8

db:EXPLOIT-DBid:50212

Trust: 0.6

db:CNNVDid:CNNVD-202101-435

Trust: 0.6

db:VULHUBid:VHN-183272

Trust: 0.1

db:VULMONid:CVE-2020-5147

Trust: 0.1

sources: VULHUB: VHN-183272 // VULMON: CVE-2020-5147 // JVNDB: JVNDB-2021-002450 // CNNVD: CNNVD-202101-435 // NVD: CVE-2020-5147

REFERENCES

url:http://packetstormsecurity.com/files/163857/sonicwall-netextender-10.2.0.300-unquoted-service-path.html

Trust: 2.7

url:https://psirt.global.sonicwall.com/vuln-detail/snwlid-2020-0023

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2020-5147

Trust: 1.4

url:https://www.exploit-db.com/exploits/50212

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/428.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-183272 // VULMON: CVE-2020-5147 // JVNDB: JVNDB-2021-002450 // CNNVD: CNNVD-202101-435 // NVD: CVE-2020-5147

SOURCES

db:VULHUBid:VHN-183272
db:VULMONid:CVE-2020-5147
db:JVNDBid:JVNDB-2021-002450
db:CNNVDid:CNNVD-202101-435
db:NVDid:CVE-2020-5147

LAST UPDATE DATE

2024-11-23T22:44:17.767000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-183272date:2021-09-21T00:00:00
db:VULMONid:CVE-2020-5147date:2021-08-17T00:00:00
db:JVNDBid:JVNDB-2021-002450date:2021-09-16T08:19:00
db:CNNVDid:CNNVD-202101-435date:2021-08-18T00:00:00
db:NVDid:CVE-2020-5147date:2024-11-21T05:33:37.780

SOURCES RELEASE DATE

db:VULHUBid:VHN-183272date:2021-01-09T00:00:00
db:VULMONid:CVE-2020-5147date:2021-01-09T00:00:00
db:JVNDBid:JVNDB-2021-002450date:2021-09-16T00:00:00
db:CNNVDid:CNNVD-202101-435date:2021-01-08T00:00:00
db:NVDid:CVE-2020-5147date:2021-01-09T01:15:13.057