CVE-2020-17388

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Tomcat configuration file. The issue results from the lack of proper restriction to the Tomcat admin console. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-10799.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-749

Affected software

VendorProductVersions
MarvellQConvergeConsole5.5.0.64

References

Timeline

Published
Aug 25, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-173898.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. AlthougCVE-2020-17393.9A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svCVE-2020-173908.8This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.2-47123. An attacker muCVE-2020-173916.5This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.3-47255. An attacker mCVE-2020-173928.8This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.3-47255. An attacker muCVE-2020-173936.5This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.3-47255. An attacker mCVE-2020-173946.0This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 15.1.4. An attackCVE-2020-173958.2This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must firCVE-2020-173968.8This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must firCVE-2020-173978.2This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must firCVE-2020-173986.5This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.4. An attacker must fiCVE-2020-173998.8This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 15.1.4. An attacker must fir
CVE-2020-17388: High severity, CVSS 8.8 | Vulnix