How severe is CVE-2020-8445?

This vulnerability has a severity rating of CRITICAL with a CVSS score of 9.8 out of 10.

What type of vulnerability is CVE-2020-8445?

This is classified as CWE-20, which is a common weakness in software security.

CVE-2020-8445 - CRITICAL Severity | CVSS 9.8

Vulnerability Description

In OSSEC-HIDS 2.7 through 3.5.0, the OS_CleanMSG function in ossec-analysisd doesn't remove or encode terminal control characters or newlines from processed log messages. In many cases, those characters are later logged. Because newlines (\n) are permitted in messages processed by ossec-analysisd, it may be possible to inject nested events into the ossec log. Use of terminal control characters may allow obfuscating events or executing commands when viewed through vulnerable terminal emulators. This may be an unauthenticated remote attack for certain types and origins of logged data.

Related Vulnerabilities

CVE-2002-2444

CRITICAL

CVSS:9.8(Critical)

Snoopy before 2.0.0 has a security hole in exec cURL

CWE-202002

CVE-2009-4488

CRITICAL

CVSS:9.8(Critical)

Varnish 2.0.6 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite ...

CWE-202009

CVE-2009-4491

CRITICAL

CVSS:9.8(Critical)

thttpd 2.25b0 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite ...

CWE-202009

CVE-2010-0748

CRITICAL

CVSS:9.8(Critical)

Transmission before 1.92 allows an attacker to cause a denial of service (crash) or possibly have other unspecified impact via a large number of tr arguments in a magnet link.

CWE-202010

CVE-2010-2446

CRITICAL

CVSS:9.8(Critical)

Rbot Reaction plugin allows command execution

CWE-202010

CVE-2010-2447

CRITICAL

CVSS:9.8(Critical)

gitolite before 1.4.1 does not filter src/ or hooks/ from path names.

CWE-202010