CVE-2020-6652 – Incorrect privilege assignment allowing non-admin users to upload config files

https://notcve.org/view.php?id=CVE-2020-6652

Incorrect Privilege Assignment vulnerability in Eaton's Intelligent Power Manager (IPM) v1.67 & prior allow non-admin users to upload the system configuration files by sending specially crafted requests. This can result in non-admin users manipulating the system configurations via uploading the configurations with incorrect parameters. Una vulnerabilidad de Asignación de Privilegios Incorrecta en Eaton Intelligent Power Manager (IPM) versiones v1.67 y anteriores, permite a los usuarios no administradores cargar los archivos de configuración del sistema mediante el envío de peticiones especialmente diseñadas. Esto puede resultar en que usuarios no administradores manipulen las configuraciones del sistema al cargar las configuraciones con parámetros incorrectos. This vulnerability allows remote attackers to escalate privileges on affected installations of Eaton Intelligent Power Manager. • https://www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/eaton-vulnerability-advisory-intelligent-power-manager-v1-1.pdf https://www.zerodayinitiative.com/advisories/ZDI-20-650 • CWE-266: Incorrect Privilege Assignment CWE-269: Improper Privilege Management •