CVEvulnerability

CVE-2020-25490

7.3 HIGH Published 2020-09-17 Modified 2026-06-17 Official page ↗

Status: Modified
Published: 2020-09-17
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.3 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 2.0 ([email protected]): 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses: CWE-347

Description

Lack of cryptographic signature verification in the Sqreen PHP agent daemon before 1.16.0 makes it easier for remote attackers to inject rules for execution inside the virtual machine.

Affected configurations

• sqreen php microagent (< 1.16.0)

Weakness · CWE (1)

CWE-347 Improper Verification of Cryptographic Signature weakness

References

https://blog.sqreen.com/vulnerability-disclosure-finding-a-vulnerability-in-sqreens-php-agent-and-how-we-fixed-it/ Exploit, Vendor Advisory
https://blog.sqreen.com/vulnerability-disclosure-finding-a-vulnerability-in-sqreens-php-agent-and-how-we-fixed-it/ Exploit, Vendor Advisory

CVE-2020-25490

Description

Affected configurations

Related

Weakness · CWE (1)

References