Vulnerability Details CVE-2020-12608
An issue was discovered in SolarWinds MSP PME (Patch Management Engine) Cache Service before 1.1.15 in the Advanced Monitoring Agent. There are insecure file permissions for %PROGRAMDATA%\SolarWinds MSP\SolarWinds.MSP.CacheService\config\. This can lead to code execution by changing the CacheService.xml SISServerURL parameter.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.008
EPSS Ranking 72.6%
CVSS Severity
CVSS v3 Score 7.8
CVSS v2 Score 9.3
References
- http://packetstormsecurity.com/files/157591/SolarWinds-MSP-PME-Cache-Service-Insecure-File-Permissions-Code-Execution.html
- http://seclists.org/fulldisclosure/2020/May/23
- https://github.com/jensregel/Advisories/tree/master/CVE-2020-12608
- http://packetstormsecurity.com/files/157591/SolarWinds-MSP-PME-Cache-Service-Insecure-File-Permissions-Code-Execution.html
- http://seclists.org/fulldisclosure/2020/May/23
- https://github.com/jensregel/Advisories/tree/master/CVE-2020-12608
Products affected by CVE-2020-12608
-
cpe:2.3:a:solarwinds:managed_service_provider_patch_management_engine:*