CVE-2020-13695

Name of the Vulnerable Software and Affected Versions QuickBox Community Edition versions 2.5.5 and earlier QuickBox Pro Edition versions 2.1.8 and earlier

Description The issue allows an attacker to obtain sensitive information by exploiting the local www-data user's sudo privileges to execute grep as root without a password. This can be done via a grep of a /root/*.db or /etc/shadow file.

Recommendations For QuickBox Community Edition versions 2.5.5 and earlier, remove the sudo privileges for the www-data user to execute grep as root without a password. For QuickBox Pro Edition versions 2.1.8 and earlier, remove the sudo privileges for the www-data user to execute grep as root without a password.