{"metadata": {"vulnerability": "cve-2020-13484", "count": 16, "kinds": {"milestone": 4, "sighting": 1, "kev": 0, "other": 11}}, "data": [{"timestamp": "2020-05-25T00:00:00Z", "date_only": false, "value": "2020-05-25T00:00:00.000Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2020-13484", "field": "cveMetadata.dateReserved"}, {"timestamp": "2020-06-24T14:28:01Z", "date_only": false, "value": "2020-06-24T14:28:01.000Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2020-13484", "field": "cveMetadata.datePublished"}, {"timestamp": "2020-06-24T14:28:01Z", "date_only": false, "value": "2020-06-24T14:28:01.000Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / mitre", "record": "cve-2020-13484", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2020-06-24T15:15:00Z", "date_only": false, "value": "2020-06-24T15:15:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-7P89-XJG8-39JF", "record": "GHSA-7P89-XJG8-39JF", "field": "database_specific.nvd_published_at"}, {"timestamp": "2020-06-24T15:15:00Z", "date_only": false, "value": "2020-06-24T15:15Z", "kind": "other", "label": "Published Date", "source": "gsd \u00b7 GSD-2020-13484", "record": "GSD-2020-13484", "field": "namespaces.nvd.nist.gov.publishedDate"}, {"timestamp": "2020-06-24T15:15:11.777Z", "date_only": false, "value": "2020-06-24T15:15:11.777", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2020-13484", "record": "FKIE_CVE-2020-13484", "field": "published"}, {"timestamp": "2020-06-28T00:00:00Z", "date_only": true, "value": "2020-06-28", "kind": "other", "label": "Submit Time", "source": "cnvd \u00b7 CNVD-2021-21929", "record": "CNVD-2021-21929", "field": "submitTime"}, {"timestamp": "2020-07-02T18:27:00Z", "date_only": false, "value": "2020-07-02T18:27Z", "kind": "other", "label": "Last Modified Date", "source": "gsd \u00b7 GSD-2020-13484", "record": "GSD-2020-13484", "field": "namespaces.nvd.nist.gov.lastModifiedDate"}, {"timestamp": "2020-07-16T10:00:46Z", "date_only": false, "value": "2020-07-16T10:00:46.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/mis_team/169", "record": "CVE-2020-13484", "field": "creation_timestamp", "uuid": "c5bb2337-385d-4c45-ad3c-6a634085d176", "content": "\u0416\u0430\u0440\u043a\u0438\u0435 \u043b\u0435\u0442\u043d\u0438\u0435 \u0442\u0432\u043e\u0438\u2026 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438\n\n\u041b\u0435\u0442\u043e 2020 \u0433\u043e\u0434\u0430 \u0431\u043e\u0433\u0430\u0442\u043e \u043d\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u044e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 (\u0432\u0438\u0434\u0438\u043c\u043e \u043f\u0440\u0438\u0431\u043b\u0438\u0436\u0430\u0435\u0442\u0441\u044f \u043f\u0430\u043d\u0434\u0435\u043c\u0438\u044f \u0432 \u043c\u0438\u0440\u0435 \u0418\u0411). \u041f\u0435\u043d\u0442\u0435\u0441\u0442\u0435\u0440, \u0430 \u0442\u0435\u043c \u0431\u043e\u043b\u0435\u0435 RedTeam \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442, \u0434\u043e\u043b\u0436\u0435\u043d \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0442\u044c \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0442\u0430\u043a\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435 \u0437\u0430\u043a\u0430\u0437\u0447\u0438\u043a\u0430, \u0434\u0430\u0436\u0435 \u0435\u0441\u043b\u0438 \u0420\u043e\u0421 \u043d\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d. \u041a \u0441\u043e\u0436\u0430\u043b\u0435\u043d\u0438\u044e, \u043d\u0435 \u0432\u0441\u0435 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u043e, \u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0442\u0430\u043a\u043e\u0433\u043e \u0440\u043e\u0434\u0430 \u0434\u0435\u043b\u0430\u0435\u0442 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0431\u0435\u0437\u0437\u0430\u0449\u0438\u0442\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0434 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c. \u0414\u0435\u043b\u0438\u043c\u0441\u044f \u0441 \u0432\u0430\u043c\u0438 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u0438\u043c \u043e\u0431\u0437\u043e\u0440\u043e\u043c \u0433\u043e\u0440\u044f\u0447\u0438\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0442\u044c \u0438\u0445 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0432 \u043f\u0435\u0440\u0432\u0443\u044e \u043e\u0447\u0435\u0440\u0435\u0434\u044c.\n\n\u041f\u0430\u0442\u0447\u0438 \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u044b \u043d\u0430 \u0432\u0441\u0435 \u043e\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438. \u041f\u0440\u043e\u0432\u0435\u0440\u044c\u0442\u0435, \u0447\u0442\u043e \u043e\u043d\u0438 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u044b (\u0438\u043b\u0438 \u043d\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u044b)!\n\n1. F5 BIG-IP\n\nTMUI RCE vulnerability CVE-2020-5902\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u043c \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u043e\u043c (Traffic Management User Interface) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c, \u043d\u0435 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0438\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b, \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u0442\u044c \u0438\u043b\u0438 \u0443\u0434\u0430\u043b\u044f\u0442\u044c \u0444\u0430\u0439\u043b\u044b, \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u0442\u044c \u0441\u043b\u0443\u0436\u0431\u044b \u0438 (\u0438\u043b\u0438) \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 Java \u043a\u043e\u0434 \n\nCVSSv2: 10\nCVSSv3: 9.8\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: https://support.f5.com/csp/article/K52145254\n\n\u0420\u043e\u0421: https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/f5_bigip_tmui_rce.rb\n\n2. Citrix\n\n5 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0440\u0430\u0437\u043d\u043e\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u0438\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445: https://support.citrix.com/article/CTX276688\n\nPoC: \u043f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u043d\u0435\u0442, \u043d\u043e \u0435\u0441\u0442\u044c \u0445\u043e\u0440\u043e\u0448\u0435\u0435 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u043e\u0435 \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0432\u0441\u0435\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439: https://blog.unauthorizedaccess.nl/2020/07/07/adventures-in-citrix-security-research.html\n\n\u041e\u0434\u043d\u0430 \u0438\u0437 \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 - CVE-2020-8193\n\n\u041e\u0431\u0445\u043e\u0434 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432 Citrix ADC, Citrix Gateway, Citrix SDWAN WAN-OP\n\nCVSSv2: 5\nCVSSv3: 6.5\n\nPoC: https://github.com/jas502n/CVE-2020-8193 (\u043d\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u0435\u043d)\n\n3. Palo Alto\n\nPAN-OS: Authentication Bypass in SAML Authentication\n\n\u0412 PAN-OS \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u0430\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 \u043f\u043e\u0434\u043f\u0438\u0441\u0435\u0439 \u0432 SAML \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443, \u043d\u0435 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0435\u043c\u0443 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438 \u0432 \u0441\u0435\u0442\u0438, \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u043c \u0440\u0435\u0441\u0443\u0440\u0441\u0430\u043c\n\nCVSSv2: 9.8\nCVSSv3: 10\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: https://security.paloaltonetworks.com/CVE-2020-2021\n\nPoC: \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435 \u043d\u0435\u0442\n\n4. Windows DNS Server\n\nCVE-2020-1350\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u0440\u043e \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u0433\u043e\u0432\u043e\u0440\u044f\u0442 \u0432\u0441\u0435!\n\n\u0423\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u043d\u0430 DNS \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u043c, \u043d\u0435 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0438\u043c \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438\n\nCVSSv2: 10\nCVSSv3: 10\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1350\n\nPoC: \u0411\u0443\u0434\u044c\u0442\u0435 \u0430\u043a\u043a\u0443\u0440\u0430\u0442\u043d\u044b \u0441 \u0444\u0435\u0439\u043a\u043e\u0432\u044b\u043c\u0438 PoC!\nhttps://github.com/ZephrFish/CVE-2020-1350 - \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0435\u043c\u044b\u0439 PoC \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0444\u0435\u0439\u043a\u043e\u0432\u044b\u043c\n\n5. Bitrix\n\nBitrix SSRF CVE-2020-13484\n\n\u0412\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 Bitrix \u0434\u043e 20.0.975 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u0435\u0441\u0442\u0438 \u043f\u043e\u0434\u0434\u0435\u043b\u043a\u0443 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043a \u0432\u043d\u0435\u0448\u043d\u0438\u043c IP-\u0430\u0434\u0440\u0435\u0441\u0430\u043c + \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0438 \u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043a \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0435\u0439 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435\n\nCVSSv2: 7.5\nCVSSv3: 9.8\n\nPoC: https://gist.github.com/mariuszpoplwski/f261a4bc06adde5c78760559db9d63bd", "url": "https://t.me/mis_team/169"}, {"timestamp": "2021-03-24T00:00:00Z", "date_only": true, "value": "2021-03-24", "kind": "other", "label": "Open Time", "source": "cnvd \u00b7 CNVD-2021-21929", "record": "CNVD-2021-21929", "field": "openTime"}, {"timestamp": "2022-05-24T17:21:34Z", "date_only": false, "value": "2022-05-24T17:21:34Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-7P89-XJG8-39JF", "record": "GHSA-7P89-XJG8-39JF", "field": "published"}, {"timestamp": "2022-05-24T17:21:34Z", "date_only": false, "value": "2022-05-24T17:21:34Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-7P89-XJG8-39JF", "record": "GHSA-7P89-XJG8-39JF", "field": "modified"}, {"timestamp": "2023-12-13T01:21:46.779Z", "date_only": false, "value": "2023-12-13T01:21:46.779080Z", "kind": "other", "label": "Updated", "source": "gsd \u00b7 GSD-2020-13484", "record": "GSD-2020-13484", "field": "gsd.osvSchema.modified"}, {"timestamp": "2024-08-04T12:18:18.333Z", "date_only": false, "value": "2024-08-04T12:18:18.333Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2020-13484", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2024-08-04T12:18:18.333Z", "date_only": false, "value": "2024-08-04T12:18:18.333Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "cve-2020-13484", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-17T02:53:12.690Z", "date_only": false, "value": "2026-06-17T02:53:12.690", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2020-13484", "record": "FKIE_CVE-2020-13484", "field": "lastModified"}]}