FKIE_CVE-2020-10590

Vulnerability from fkie_nvd - Published: 2021-07-30 14:15 - Updated: 2024-11-21 04:55
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
Replicated Classic 2.x versions have an improperly secured API that exposes sensitive data from the Replicated Admin Console configuration. An attacker with network access to the Admin Console port (8800) on the Replicated Classic server could retrieve the TLS Keypair (Cert and Key) used to configure the Admin Console.
References
cve@mitre.orghttps://blog.replicated.comVendor Advisory
cve@mitre.orghttps://gradle.com/enterprise/releases/2019.5/#changesThird Party Advisory
cve@mitre.orghttps://www.replicated.com/security/advisories/CVE-2020-10590Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://blog.replicated.comVendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://gradle.com/enterprise/releases/2019.5/#changesThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://www.replicated.com/security/advisories/CVE-2020-10590Vendor Advisory
Impacted products
Vendor Product Version
replicated replicated_classic *
replicated replicated_classic *
replicated replicated_classic *
replicated replicated_classic *
replicated replicated_classic *
replicated replicated_classic *
replicated replicated_classic *
replicated replicated_classic 2.41.0
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:replicated:replicated_classic:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A13F1249-8DFC-4CCB-8E39-5237958CA278",
              "versionEndIncluding": "2.32.3",
              "versionStartIncluding": "2.10.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:replicated:replicated_classic:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EAD962E0-AD59-45C2-9AA2-825CD1589522",
              "versionEndIncluding": "2.36.0",
              "versionStartIncluding": "2.33.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:replicated:replicated_classic:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "10023122-0F02-4D4A-B413-5227EE939BB7",
              "versionEndIncluding": "2.37.1",
              "versionStartIncluding": "2.37.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:replicated:replicated_classic:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "ADFC23B4-835F-4ACC-91E2-76752F14E7A3",
              "versionEndIncluding": "2.38.5",
              "versionStartIncluding": "2.38.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:replicated:replicated_classic:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "10D63E7B-B00E-4F2B-AF6D-DAA6EAC614F9",
              "versionEndIncluding": "2.39.3",
              "versionStartIncluding": "2.39.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:replicated:replicated_classic:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "8EC5AF21-62BD-4883-8941-7690D7EEF64F",
              "versionEndIncluding": "2.40.3",
              "versionStartIncluding": "2.40.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:replicated:replicated_classic:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "304928C9-4462-43C1-99E3-7C01101E4DAB",
              "versionEndIncluding": "2.42.3",
              "versionStartIncluding": "2.42.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:replicated:replicated_classic:2.41.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "0350B1B8-C397-4CE1-B9E7-73D93B80DA6B",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Replicated Classic 2.x versions have an improperly secured API that exposes sensitive data from the Replicated Admin Console configuration. An attacker with network access to the Admin Console port (8800) on the Replicated Classic server could retrieve the TLS Keypair (Cert and Key) used to configure the Admin Console."
    },
    {
      "lang": "es",
      "value": "Replicated Classic versiones 2.x, presentan una API asegurada inapropiadamente que expone datos confidenciales de la configuraci\u00f3n de la Consola de Administraci\u00f3n Replicada. Un atacante con acceso de red al puerto de la Consola de Administraci\u00f3n (8800) en el servidor de Replicated Classic podr\u00eda recuperar el par de claves TLS (Cert y Key) usado para configurar la Consola de Administraci\u00f3n"
    }
  ],
  "id": "CVE-2020-10590",
  "lastModified": "2024-11-21T04:55:39.207",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-07-30T14:15:12.930",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://blog.replicated.com"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://gradle.com/enterprise/releases/2019.5/#changes"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.replicated.com/security/advisories/CVE-2020-10590"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://blog.replicated.com"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://gradle.com/enterprise/releases/2019.5/#changes"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.replicated.com/security/advisories/CVE-2020-10590"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.