PatchTheCVEgogogate vulnerabilities
Recent CVEs affecting gogogate products. 11 tracked.
gogogate has 11 tracked vulnerabilities, 4 critical. A fixed release or vendor patch exists for 0. Most recent: 2020-09-24. Highest priority: CVE-2020-12842 (score 63/100).
- CVE-2020-13119 HIGH 8.1 MITIGATE ismartgate PRO 1.5.9 is vulnerable to clickjacking.
- CVE-2020-12843 CRITICAL 9.8 MITIGATE ismartgate PRO 1.5.9 is vulnerable to malicious file uploads via the form for uploading sounds to garage doors
- CVE-2020-12842 CRITICAL 9.8 MITIGATE ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/checkUserExpirationD
- CVE-2020-12841 MEDIUM 6.5 MITIGATE ismartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to upload imae files via /index.php
- CVE-2020-12840 MEDIUM 6.5 MITIGATE ismartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to upload sound files via /index.php
- CVE-2020-12839 CRITICAL 9.8 MITIGATE ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/checkExpirationDate.
- CVE-2020-12838 CRITICAL 9.8 MITIGATE ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/mailAdmin.php.
- CVE-2020-12837 HIGH 7.5 MITIGATE ismartgate PRO 1.5.9 is vulnerable to malicious file uploads via the form for uploading images to garage doors
- CVE-2020-12282 HIGH 8.8 MITIGATE iSmartgate PRO 1.5.9 is vulnerable to CSRF via the busca parameter in the form used for searching for users, a
- CVE-2020-12281 MEDIUM 6.5 MITIGATE iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to create a new user via /index.php.
- CVE-2020-12280 MEDIUM 6.5 MITIGATE iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remote attackers to open/close a specified garage door/
FAQ
How do I fix gogogate vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is gogogate being exploited right now?
None of the tracked gogogate CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which gogogate CVE should I patch first?
CVE-2020-12842 currently ranks highest (63/100): ismartgate PRO 1.5.9 is vulnerable to privilege escalation by appending PHP code to /cron/checkUserExpirationD.