Rule History

SID: 2030644 • Source: et/open

Versions (3)

Version DetailsCurrent

Rev: 1 • Aug 4, 2020, 12:00 PM

Message:

ET WEB_SPECIFIC_APPS LifterLMS Arbitrary File Write Attempt Inbound (CVE-2020-6008)

Rule:

alert http any any -> [$HTTP_SERVERS,$HOME_NET] any (msg:"ET WEB_SPECIFIC_APPS LifterLMS Arbitrary File Write Attempt Inbound (CVE-2020-6008)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"action=export_admin_table"; content:"&filename=../"; fast_pattern; reference:url,cpr-zero.checkpoint.com/vulns/cprid-2148/; reference:cve,2020-6008; classtype:attempted-admin; sid:2030644; rev:1; metadata:created_at 2020_08_04, cve CVE_2020_6008, deployment Perimeter, performance_impact Low, confidence High, signature_severity Major, updated_at 2020_08_04;)

Created:

Aug 4, 2020, 12:00 PM

Updated:

Aug 4, 2020, 12:00 PM

DB Created:

Sep 21, 2024, 3:00 AM

DB Updated:

Sep 21, 2024, 3:00 AM

Filename:

rules/emerging-web_specific_apps.rules