SMC serverd XSS

Advisory ID CVE Number Date discovered Severity Advisory revision
STORM-2020-006 02/19/2020 medium v1

Vulnerability details

SMC execute remote code from serverd response, a compromised SNS can be an attack vector for SMC.

Impacted products

ProductsSeverityDetail
Stormshield Network Security medium Fixed

Revisions

Version Date Description
v1 Initial release


Stormshield Network Security

CVSS v2 Overall Score: 5.7      

Analysis

Impacted version

SMC frontend application prevents remote code execution, where SNS returns are displayed.

SMC < 2.6.4

Workaround solution

Solution

There is no workaround solution.

The SMC 2.6.4 update will fix this vulnerability.



Access vector Access complexity Authentication Confidentiality impact Integrity impact Availability impact
Network High Single Partial Partial None
CVSS Base score: 3.6 CVSS Vector: (AV:N/AC:H/Au:S/C:P/I:P/A:N)
Exploitability Remediation Level Report Confidence
Proof of concept code Official fix Confirmed
CVSS Temporal score: 2.8 CVSS Vector: (AV:N/AC:H/Au:S/C:P/I:P/A:N/E:POC/RL:OF/RC:C)
Collateral Damage Potential Target Distribution
Medium-High High [76-100%]
CVSS Environmental score: 5.7 CVSS Vector: (AV:N/AC:H/Au:S/C:P/I:P/A:N/E:POC/RL:OF/RC:C/CDP:MH/TD:H/CR:ND/IR:ND/AR:ND)