CVE-2020-12608: Critical severity solarwinds managed service provider patch management engine vulnerability
An issue was discovered in SolarWinds MSP PME (Patch Management Engine) Cache Service before 1.1.15 in the Advanced Monitoring Agent. There are insecure file permissions for %PROGRAMDATA%\SolarWinds MSP\SolarWinds.MSP.CacheService\config\. This can lead to code execution by changing the CacheService.xml SISServerURL parameter.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-12608?
CVE-2020-12608 is considered a high severity vulnerability due to the potential for code execution via insecure file permissions.
How do I fix CVE-2020-12608?
To fix CVE-2020-12608, update the SolarWinds MSP Patch Management Engine to version 1.1.15 or later.
What software is affected by CVE-2020-12608?
CVE-2020-12608 affects versions of SolarWinds Managed Service Provider Patch Management Engine prior to 1.1.15.
What type of vulnerability is CVE-2020-12608?
CVE-2020-12608 is an insecure file permissions vulnerability that may allow unauthorized code execution.
Where are the insecure permissions located in CVE-2020-12608?
The insecure permissions in CVE-2020-12608 are located in the config directory at %PROGRAMDATA%\SolarWinds MSP\SolarWinds.MSP.CacheService\