gsd - gsd-2020-15269

GSD-2020-15269

Vulnerability from gsd - Updated: 2020-10-20 00:00

Details

### Impact The perpetrator who previously obtained an old expired user token could use it to access Storefront API v2 endpoints. ### Patches Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version.

Aliases

CVE-2020-15269

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2020-15269",
    "description": "In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.",
    "id": "GSD-2020-15269"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "spree",
            "purl": "pkg:gem/spree"
          }
        }
      ],
      "aliases": [
        "CVE-2020-15269",
        "GHSA-f8cm-364f-q9qh"
      ],
      "details": "### Impact\n\nThe perpetrator who previously obtained an old expired user\ntoken could use it to access Storefront API v2 endpoints.\n\n### Patches\n\nPlease upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version.\n",
      "id": "GSD-2020-15269",
      "modified": "2020-10-20T00:00:00.000Z",
      "published": "2020-10-20T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 7.4,
          "type": "CVSS_V3"
        }
      ],
      "summary": "Ensure that doorkeeper_token is valid when authenticating requests in API v2 calls"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2020-15269",
        "STATE": "PUBLIC",
        "TITLE": "Expired token reuse in Spree"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "spree",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003c 3.7.11"
                        },
                        {
                          "version_value": "\u003e= 4.0.0, \u003c 4.0.4"
                        },
                        {
                          "version_value": "\u003e= 4.1.0, \u003c 4.1.11"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "spree"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "{\"CWE-287\":\"Improper Authentication\"}"
              }
            ]
          },
          {
            "description": [
              {
                "lang": "eng",
                "value": "{\"CWE-613\":\"Insufficient Session Expiration\"}"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh",
            "refsource": "CONFIRM",
            "url": "https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh"
          },
          {
            "name": "https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847",
            "refsource": "MISC",
            "url": "https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-f8cm-364f-q9qh",
        "discovery": "UNKNOWN"
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2020-15269",
      "cvss_v3": 7.4,
      "date": "2020-10-20",
      "description": "### Impact\n\nThe perpetrator who previously obtained an old expired user\ntoken could use it to access Storefront API v2 endpoints.\n\n### Patches\n\nPlease upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version.\n",
      "gem": "spree",
      "ghsa": "f8cm-364f-q9qh",
      "patched_versions": [
        "~\u003e 3.7.11",
        "~\u003e 4.0.4",
        "\u003e= 4.1.11"
      ],
      "title": "Ensure that doorkeeper_token is valid when authenticating requests in API v2 calls",
      "unaffected_versions": [
        "\u003c 3.7.0"
      ],
      "url": "https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c3.7.11||\u003e=4.0.0 \u003c4.0.4||\u003e=4.1.0 \u003c4.1.11",
          "affected_versions": "All versions before 3.7.11, all versions starting from 4.0.0 before 4.0.4, all versions starting from 4.1.0 before 4.1.11",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-287",
            "CWE-937"
          ],
          "date": "2020-10-30",
          "description": "Expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched A workaround without upgrading is described in the linked advisory.",
          "fixed_versions": [
            "3.7.11",
            "4.0.4",
            "4.1.11"
          ],
          "identifier": "CVE-2020-15269",
          "identifiers": [
            "CVE-2020-15269",
            "GHSA-f8cm-364f-q9qh"
          ],
          "not_impacted": "All versions starting from 3.7.11 before 4.0.0, all versions starting from 4.0.4 before 4.1.0, all versions starting from 4.1.11",
          "package_slug": "gem/spree",
          "pubdate": "2020-10-20",
          "solution": "Upgrade to versions 3.7.11, 4.0.4, 4.1.11 or above.",
          "title": "Improper Authentication",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2020-15269",
            "https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847",
            "https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh"
          ],
          "uuid": "241a4a29-f27c-4dee-9992-1f125e243f6e"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:sparksolutions:spree:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "3.7.11",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sparksolutions:spree:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "4.0.4",
                "versionStartIncluding": "4.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sparksolutions:spree:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "4.1.11",
                "versionStartIncluding": "4.1.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-15269"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-613"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847",
              "refsource": "MISC",
              "tags": [
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847"
            },
            {
              "name": "https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 4.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 5.2
        }
      },
      "lastModifiedDate": "2021-11-18T16:21Z",
      "publishedDate": "2020-10-20T21:15Z"
    }
  }
}

CVE-2020-15269 (GCVE-0-2020-15269)

Vulnerability from cvelistv5 – Published: 2020-10-20 20:15 – Updated: 2024-08-04 13:15

Title

Expired token reuse in Spree

Summary

In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory.

Severity ?

7.4 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CWE

CWE-287 - {"CWE-287":"Improper Authentication"}
CWE-613 - {"CWE-613":"Insufficient Session Expiration"}

Assigner

GitHub_M

References

URL

Tags

	https://github.com/spree/spree/security/advisorie…	x_refsource_CONFIRM
	https://github.com/spree/spree/commit/e43643abfe5…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	spree	spree	Affected: < 3.7.11 Affected: >= 4.0.0, < 4.0.4 Affected: >= 4.1.0, < 4.1.11

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:15:18.944Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "spree",
          "vendor": "spree",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 3.7.11"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.0.0, \u003c 4.0.4"
            },
            {
              "status": "affected",
              "version": "\u003e= 4.1.0, \u003c 4.1.11"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "{\"CWE-287\":\"Improper Authentication\"}",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-613",
              "description": "{\"CWE-613\":\"Insufficient Session Expiration\"}",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-10-20T20:15:14",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847"
        }
      ],
      "source": {
        "advisory": "GHSA-f8cm-364f-q9qh",
        "discovery": "UNKNOWN"
      },
      "title": "Expired token reuse in Spree",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-15269",
          "STATE": "PUBLIC",
          "TITLE": "Expired token reuse in Spree"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "spree",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 3.7.11"
                          },
                          {
                            "version_value": "\u003e= 4.0.0, \u003c 4.0.4"
                          },
                          {
                            "version_value": "\u003e= 4.1.0, \u003c 4.1.11"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "spree"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Spree before versions 3.7.11, 4.0.4, or 4.1.11, expired user tokens could be used to access Storefront API v2 endpoints. The issue is patched in versions 3.7.11, 4.0.4 and 4.1.11. A workaround without upgrading is described in the linked advisory."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "{\"CWE-287\":\"Improper Authentication\"}"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "{\"CWE-613\":\"Insufficient Session Expiration\"}"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh",
              "refsource": "CONFIRM",
              "url": "https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh"
            },
            {
              "name": "https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847",
              "refsource": "MISC",
              "url": "https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-f8cm-364f-q9qh",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-15269",
    "datePublished": "2020-10-20T20:15:14",
    "dateReserved": "2020-06-25T00:00:00",
    "dateUpdated": "2024-08-04T13:15:18.944Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GHSA-F8CM-364F-Q9QH

Vulnerability from github – Published: 2020-10-20 20:03 – Updated: 2021-11-19 13:51

Summary

Ensure that doorkeeper_token is valid when authenticating requests in API v2 calls

Details

Impact

The perpetrator who previously obtained an old expired user token could use it to access Storefront API v2 endpoints.

Patches

Please upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version.

Workarounds

In your project directory create a decorator file app/controllers/spree/api/v2/base_controller_decotatror.rb with contents:

module Spree
  module Api
    module V2
      module BaseControllerDecorator
        private

        def spree_current_user
          return nil unless doorkeeper_token
          return @spree_current_user if @spree_current_user

          doorkeeper_authorize!

          @spree_current_user ||= ::Spree.user_class.find_by(id: doorkeeper_token.resource_owner_id)
        end
     end
  end
end

Spree::Api::V2::BaseController.prepend(Spree::Api::V2::BaseControllerDecorator)

For more information

If you have any questions or comments about this advisory: * Email us at security@spreecommerce.org

Severity ?

7.4 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "spree"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "3.7.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "spree"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.0.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "spree"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.1.0"
            },
            {
              "fixed": "4.1.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2020-15269"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-613"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-10-20T20:03:19Z",
    "nvd_published_at": "2020-10-20T21:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nThe perpetrator who previously obtained an old expired user token could use it to access Storefront API v2 endpoints. \n\n### Patches\nPlease upgrade to 3.7.11, 4.0.4, or 4.1.11 depending on your used Spree version. \n\n### Workarounds\nIn your project directory create a decorator file `app/controllers/spree/api/v2/base_controller_decotatror.rb` with contents:\n\n```ruby\nmodule Spree\n  module Api\n    module V2\n      module BaseControllerDecorator\n        private\n\n        def spree_current_user\n          return nil unless doorkeeper_token\n          return @spree_current_user if @spree_current_user\n\n          doorkeeper_authorize!\n\n          @spree_current_user ||= ::Spree.user_class.find_by(id: doorkeeper_token.resource_owner_id)\n        end\n     end\n  end\nend\n\nSpree::Api::V2::BaseController.prepend(Spree::Api::V2::BaseControllerDecorator)\n```\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [security@spreecommerce.org](mailto:security@spreecommerce.org)",
  "id": "GHSA-f8cm-364f-q9qh",
  "modified": "2021-11-19T13:51:14Z",
  "published": "2020-10-20T20:03:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/security/advisories/GHSA-f8cm-364f-q9qh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15269"
    },
    {
      "type": "WEB",
      "url": "https://github.com/spree/spree/commit/e43643abfe51f54bd9208dd02298b366e9b9a847"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/spree/CVE-2020-15269.yml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/spree/spree"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Ensure that doorkeeper_token is valid when authenticating requests in API v2 calls"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GSD-2020-15269

CVE-2020-15269 (GCVE-0-2020-15269)

GHSA-F8CM-364F-Q9QH

Impact

Patches

Workarounds

For more information

Tags

Sightings

Nomenclature