CVE-2020-27869

This vulnerability allows remote attackers to escalate privileges on affected installations of SolarWinds Network Performance Monitor 2020 HF1, NPM: 2020.2. Authentication is required to exploit this vulnerability. The specific flaw exists within the WriteToFile method. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to escalate privileges and reset the password for the Admin user. Was ZDI-CAN-11804.

Summary:

Reference Links(if available):

https://www.zerodayinitiative.com/advisories/ZDI-21-064/

CVSS Score (if available)

v2: / MEDIUMAV:N/AC:L/Au:S/C:C/I:C/A:C

v3: / HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Links to Exploits(if available)

Tags: CVE, CVE-2020-27869, MISC, Third Party Advisory, vulnerability

CVE-2020-27869

Summary:

Reference Links(if available):

CVSS Score (if available)

Links to Exploits(if available)

[AKIRA] – Ransomware Victim: Billet Precision (billetprecision[.]ca)

[CACTUS] – Ransomware Victim: ptcky[.]com

Cobalt Strike Beacon Detected – 112[.]124[.]71[.]123:443

Cobalt Strike Beacon Detected – 54[.]238[.]39[.]64:443

Cobalt Strike Beacon Detected – 103[.]30[.]40[.]70:80

Summary:

Reference Links(if available):

CVSS Score (if available)

Links to Exploits(if available)

You may have missed

[AKIRA] – Ransomware Victim: Billet Precision (billetprecision[.]ca)

[CACTUS] – Ransomware Victim: ptcky[.]com

Cobalt Strike Beacon Detected – 112[.]124[.]71[.]123:443

Cobalt Strike Beacon Detected – 54[.]238[.]39[.]64:443

Cobalt Strike Beacon Detected – 103[.]30[.]40[.]70:80