CVE-2020-5519

EUVD-2020-26682
The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not strictly check request URLs, as demonstrated by the "Server Configuration > External App" screen.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 66%
Affected Products (NVD)
VendorProductVersion
litespeedtechopenlitespeed
𝑥
< 1.6.5
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://drive.google.com/open?id=1pSciFEfjHp3kN8y5shy_zosJo7dje_fX
https://forum.openlitespeed.org/threads/openlitespeed-v1-6-5-now-available.4047/
https://drive.google.com/open?id=1pSciFEfjHp3kN8y5shy_zosJo7dje_fX
https://forum.openlitespeed.org/threads/openlitespeed-v1-6-5-now-available.4047/