VDB-165300 · CVE-2020-15929 · 49077

Ortus TestBox up to 4.1.0 Query String HTMLRunner.cfm command injection

A vulnerability was found in Ortus TestBox up to 4.1.0. It has been classified as critical. Affected is some unknown functionality of the file system/runners/HTMLRunner.cfm of the component Query String Handler. There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

User

Field

Commit Conf

Approve Conf

ID	Commited	User	Field	Change	Remarks	Moderated	Reason	C
10716738	12/10/2020	VulD...	cvss3_nvd_basescore	9.8	nist.gov	12/10/2020	accepted	90
10716737	12/10/2020	VulD...	cvss2_nvd_basescore	7.5	nist.gov	12/10/2020	accepted	90
10716736	12/10/2020	VulD...	price_0day	$0-$5k	see documentation	12/10/2020	accepted	90
10716735	12/10/2020	VulD...	cvss3_meta_tempscore	7.6	see documentation	12/10/2020	accepted	90
10716734	12/10/2020	VulD...	cvss3_meta_basescore	8.0	see documentation	12/10/2020	accepted	90
10716733	12/10/2020	VulD...	cvss2_nvd_ai	P	nvd.nist.gov	12/10/2020	accepted	70
10716732	12/10/2020	VulD...	cvss2_nvd_ii	P	nvd.nist.gov	12/10/2020	accepted	70
10716731	12/10/2020	VulD...	cvss2_nvd_ci	P	nvd.nist.gov	12/10/2020	accepted	70
10716730	12/10/2020	VulD...	cvss2_nvd_au	N	nvd.nist.gov	12/10/2020	accepted	70
10716729	12/10/2020	VulD...	cvss2_nvd_ac	L	nvd.nist.gov	12/10/2020	accepted	70
10716728	12/10/2020	VulD...	cvss2_nvd_av	N	nvd.nist.gov	12/10/2020	accepted	70
10716727	12/10/2020	VulD...	cvss3_nvd_a	H	nvd.nist.gov	12/10/2020	accepted	70
10716726	12/10/2020	VulD...	cvss3_nvd_i	H	nvd.nist.gov	12/10/2020	accepted	70
10716725	12/10/2020	VulD...	cvss3_nvd_c	H	nvd.nist.gov	12/10/2020	accepted	70
10716724	12/10/2020	VulD...	cvss3_nvd_s	U	nvd.nist.gov	12/10/2020	accepted	70
10716723	12/10/2020	VulD...	cvss3_nvd_ui	N	nvd.nist.gov	12/10/2020	accepted	70
10716722	12/10/2020	VulD...	cvss3_nvd_pr	N	nvd.nist.gov	12/10/2020	accepted	70
10716721	12/10/2020	VulD...	cvss3_nvd_ac	L	nvd.nist.gov	12/10/2020	accepted	70
10716720	12/10/2020	VulD...	cvss3_nvd_av	N	nvd.nist.gov	12/10/2020	accepted	70
10716719	12/10/2020	VulD...	cwe	77 (privilege escalation)	nvd.nist.gov	12/10/2020	accepted	70