CVE-2020-11016

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

IntelMQ Manager from version 1.1.0 and before version 2.1.1 has a vulnerability where the backend incorrectly handled messages given by user-input in the "send" functionality of the Inspect-tool of the Monitor component. An attacker with access to the IntelMQ Manager could possibly use this issue to execute arbitrary code with the privileges of the webserver. Version 2.1.1 fixes the vulnerability.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
certtools	IntelMQ Manager	>= 1.1.0, < 2.1.1

References

https://github.com/certtools/intelmq-manager/commit/b9a2ac43a4f99d764b827108f6a99dc4a9faa013Patch, Third Party Advisory
https://github.com/certtools/intelmq-manager/releases/tag/2.1.1Third Party Advisory
https://github.com/certtools/intelmq-manager/security/advisories/GHSA-rrhh-rcgp-q2m2Patch, Third Party Advisory
https://lists.cert.at/pipermail/intelmq-users/2020-April/000161.htmlThird Party Advisory
https://github.com/certtools/intelmq-manager/commit/b9a2ac43a4f99d764b827108f6a99dc4a9faa013Patch, Third Party Advisory
https://github.com/certtools/intelmq-manager/releases/tag/2.1.1Third Party Advisory
https://github.com/certtools/intelmq-manager/security/advisories/GHSA-rrhh-rcgp-q2m2Patch, Third Party Advisory
https://lists.cert.at/pipermail/intelmq-users/2020-April/000161.htmlThird Party Advisory

Timeline

Published: Apr 30, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-110176.5In FreeRDP less than or equal to 2.0.0, by providing manipulated input a malicious client can create a double free condition and crash the s CVE-2020-110186.5In FreeRDP less than or equal to 2.0.0, a possible resource exhaustion vulnerability can be performed. Malicious clients could trigger out o CVE-2020-110196.5In FreeRDP less than or equal to 2.0.0, when running with logger set to "WLOG_TRACE", a possible crash of application could occur due to a r CVE-2020-11028.8A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application pa CVE-2020-110209.8Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1.0.4, 1.1.3 and 1.2.5, has the potential for authentication bypass in the extens CVE-2020-110217.5Actions Http-Client (NPM @actions/http-client) before version 1.0.8 can disclose Authorization headers to incorrect domain in certain redire CVE-2020-110226.1In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM man CVE-2020-110236.1In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even CVE-2020-110248.2In Moonlight iOS/tvOS before 4.0.1, the pairing process is vulnerable to a man-in-the-middle attack. The bug has been fixed in Moonlight v4.CVE-2020-110255.4In affected versions of WordPress, a cross-site scripting (XSS) vulnerability in the navigation section of Customizer allows JavaScript code CVE-2020-110265.4In affected versions of WordPress, files with a specially crafted name when uploaded to the Media section can lead to script execution upon CVE-2020-110278.1In affected versions of WordPress, a password reset link emailed to a user does not expire upon changing the user password. Access would be