Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveMitreCVE-2020-9388
HistoryFeb 03, 2021 - 8:15 p.m.

CVE-2020-9388

2021-02-0320:15:13
CWE-352
mitre
web.nvd.nist.gov
35
3
csrf
protection
squaredup
4.6.0
administrator
code execution
html
svg
payload
nvd
cve-2020-9388

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

28.0%

JSON

CSRF protection was not present in SquaredUp before version 4.6.0. A CSRF attack could have been possible by an administrator executing arbitrary code in a HTML dashboard tile via a crafted HTML page, or by uploading a malicious SVG payload into a dashboard.

Affected configurations

Nvd
Node
squaredupsquaredupRange<4.6azure
OR
squaredupsquaredupRange≤4.6system_center_operations_manager
VendorProductVersionCPE
squaredupsquaredup*cpe:2.3:a:squaredup:squaredup:*:*:*:*:azure:*:*:*
squaredupsquaredup*cpe:2.3:a:squaredup:squaredup:*:*:*:*:system_center_operations_manager:*:*:*

Social References

More

Related

nvd 1
prion 1
cvelist 1
nvd
nvd
CVE-2020-9388
2021-02-03 20:15:13
prion
prion
Cross site request forgery (csrf)
2021-02-03 20:15:00
cvelist
cvelist
CVE-2020-9388
2021-02-03 00:00:00

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

AI Score

6.6

Confidence

High

EPSS

0.001

Percentile

28.0%

JSON
Related for CVE-2020-9388
nvd1prion1cvelist1