CVE-2020-9398: SQL Injection

Q: What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2020-9398.

Q: What is the severity of CVE-2020-9398?

The severity of CVE-2020-9398 is critical with a CVSS score of 9.8.

Q: What is the affected software?

The affected software is ISPConfig before 3.1.15p3.

Q: How can the SQL Injection be exploited?

The SQL Injection can be exploited when the undocumented reverse_proxy_panel_allowed=sites option is manually enabled.

Q: How can the vulnerability be fixed?

The vulnerability can be fixed by upgrading to ISPConfig version 3.1.15p3.

Published Feb 25, 2020

Updated

ISPConfig before 3.1.15p3, when the undocumented reverseproxypanelallowed=sites option is manually enabled, allows SQL Injection.

Affected Software

4 affected components

ISPConfig ISPConfig<3.1.15

ISPConfig ISPConfig=3.1.15

ISPConfig ISPConfig=3.1.15-p1

ISPConfig ISPConfig=3.1.15-p2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ISPConfig to a version that resolves this vulnerability.
Fixed in 3.1.15p3
Configuration
Do not manually enable the undocumented reverse_proxy_panel_allowed=sites option; remove/disable this manual setting to prevent SQL Injection exposure in ISPConfig versions before 3.1.15p3.
ISPConfig reverse_proxy_panel_allowed option reverse_proxy_panel_allowed = sites

Event History

Feb 25, 2020

CVE Published

via MITRE·08:23 PM

Data Sourced

via MITRE·08:23 PM

Description

Data Sourced

via NVD·09:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2020-9398.

What is the severity of CVE-2020-9398?