FKIE_CVE-2020-18305

Vulnerability from fkie_nvd - Published: 2024-05-14 06:36 - Updated: 2025-06-11 14:57
Severity ?
8.0 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Summary
Extreme Networks EXOS before v.22.7 and before v.30.2 was discovered to contain an issue in its Web GUI which fails to restrict URL access, allowing attackers to access sensitive information or escalate privileges.
References
cve@mitre.orghttps://gist.github.com/yasinyilmaz/1fe3fe58dd275edb77dcbe890fce2f2cExploit
af854a3a-2127-422b-91ae-364da2661108https://gist.github.com/yasinyilmaz/1fe3fe58dd275edb77dcbe890fce2f2cExploit
Impacted products
Vendor Product Version
extremenetworks extremexos *
extremenetworks extremexos 30.1
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:extremenetworks:extremexos:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "37518AD5-2C1D-4987-A763-C7FC979DE85E",
              "versionEndExcluding": "22.7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:extremenetworks:extremexos:30.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "346C9759-A35D-4310-B8F1-2CBB50F183C8",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Extreme Networks EXOS before v.22.7 and before v.30.2 was discovered to contain an issue in its Web GUI which fails to restrict URL access, allowing attackers to access sensitive information or escalate privileges."
    },
    {
      "lang": "es",
      "value": "Se descubri\u00f3 que Extreme Networks EXOS anteriores a v.22.7 y anteriores a v.30.2 conten\u00eda un problema en su GUI web que no restringe el acceso a la URL, lo que permite a los atacantes acceder a informaci\u00f3n confidencial o escalar privilegios."
    }
  ],
  "id": "CVE-2020-18305",
  "lastModified": "2025-06-11T14:57:21.840",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.0,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.1,
        "impactScore": 5.9,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-05-14T06:36:01.630",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Exploit"
      ],
      "url": "https://gist.github.com/yasinyilmaz/1fe3fe58dd275edb77dcbe890fce2f2c"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit"
      ],
      "url": "https://gist.github.com/yasinyilmaz/1fe3fe58dd275edb77dcbe890fce2f2c"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.