Unscored CVE-2020-25563 EUVD-2020-18247GHSA-9c73-v5wq-r6q8

In SapphireIMS 5.0, it is possible to create local administrator on any client without requiring any credentials by directly accessing Remo…

Published Aug 11, 2021 · Updated Aug 4, 2024 · Assigned by mitre

Description

In SapphireIMS 5.0, it is possible to create local administrator on any client without requiring any credentials by directly accessing RemoteMgmtTaskSave (Automation Tasks) feature and not having a JSESSIONID.

References

https://vuln.shellcoder.party/tags/sapphireims/
https://vuln.shellcoder.party/2020/09/19/cve-2020-25563-sapphireims-unauthenticated-remote-command-execution-create-local-admin-on-clients/