Remote code execution in Message sending functionality in IntelMQ Manager
Priority MEDIUM 44CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- Low · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.
Summary
IntelMQ Manager from version 1.1.0 and before version 2.1.1 has a vulnerability where the backend incorrectly handled messages given by user-input in the "send" functionality of the Inspect-tool of the Monitor component. An attacker with access to the IntelMQ Manager could possibly use this issue to execute arbitrary code with the privileges of the webserver. Version 2.1.1 fixes the vulnerability.
Why it matters now
EPSS 0.02334 83rd percentileScored 2026-11-07
Fix Fixed IntelMQ Manager (certtools): 2.1.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| certtools | IntelMQ Manager | 1.1.0 to before 2.1.1 | 2.1.1 | Patch available | CNA |
- IntelMQ Manager Vendorcerttools Affected 1.1.0 to before 2.1.1 Fixed in 2.1.1 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:intelmq_manager_project:intelmq_manager:*:*:*:*:*:*:*:* | 1.1.0 to before 2.1.1 | Vulnerable | Intelmq Manager Project |
- cpe:2.3:a:intelmq_manager_project:intelmq_manager:*:*:*:*:*:*:*:* Versions 1.1.0 to before 2.1.1 Vulnerable ·Intelmq Manager Project
Remediation
- Fix · CNA IntelMQ Manager (certtools) Fixed in 2.1.1
Timeline
- 2026-10-02 Threatist record created from CVE-2020-11016
References
Patch 2
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences