VulnerabilityModified
CVE-2020-17506
Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php.
CRITICAL 9.8EPSS 94.0%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 94.0%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.
Description
Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 93.97% probability · 100th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- articatech/web proxy
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/158868/Artica-Proxy-4.3.0-Authentication-Bypass.htmlExploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/159267/Artica-Proxy-4.30.000000-Authentication-Bypass-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
- https://blog.max0x4141.com/post/artica_proxy/Exploit, Third Party Advisory
- http://packetstormsecurity.com/files/158868/Artica-Proxy-4.3.0-Authentication-Bypass.htmlExploit, Third Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/159267/Artica-Proxy-4.30.000000-Authentication-Bypass-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
- https://blog.max0x4141.com/post/artica_proxy/Exploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.