// For flags

CVE-2020-15865

 

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A Remote Code Execution vulnerability in Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0 allows an attacker to encode C# scripts as base-64 in the report XML file so that they will be compiled and executed on the server that processes this file. This can be used to fully compromise the server.

Una vulnerabilidad de ejecución de código remota en Stimulsoft (también se conoce como Stimulsoft Reports) versiones 2013.1.1600.0, permite a un atacante codificar scripts C# como base-64 en el archivo XML del reporte para que sean compilados y ejecutados en el servidor que procesa este archivo. Esto puede ser utilizado para comprometer completamente el servidor.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-07-21 CVE Reserved
  • 2020-08-18 CVE Published
  • 2024-08-04 CVE Updated
  • 2024-08-04 First Exploit
  • 2024-09-27 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Stimulsoft
Search vendor "Stimulsoft"
 Reports
Search vendor "Stimulsoft" for product "Reports"
 2013.1.1600.0
Search vendor "Stimulsoft" for product "Reports" and version "2013.1.1600.0"
-
Affected