Lucene search
MitreCVELIST:CVE-2020-26171HistoryDec 18, 2020 - 9:28 a.m.
CVE-2020-26171
2020-12-1809:28:06
mitre
www.cve.org
2
insecure
document attachment
vulnerability
manipulated
workitems
CVSS3
4.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
AI Score
4.7
Confidence
High
EPSS
0.001
Percentile
24.8%
In tangro Business Workflow before 1.18.1, the documentId of attachment uploads to /api/document/attachments/upload can be manipulated. By doing this, users can add attachments to workitems that do not belong to them.
Related
prion
prion
Code injection
2020-12-18 10:15:00
cve
cve
CVE-2020-26171
2020-12-18 10:15:12
nvd
nvd
CVE-2020-26171
2020-12-18 10:15:12
CVSS3
4.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
AI Score
4.7
Confidence
High
EPSS
0.001
Percentile
24.8%
Related for CVELIST:CVE-2020-26171