Lucene search

VulDBCVELIST:CVE-2020-36660

HistoryFeb 06, 2023 - 4:31 p.m.

CVE-2020-36660 paxswill EVE Ship Replacement Program User Information api.py information disclosure

2023-02-0616:31:02

CWE-200

VulDB

www.cve.org

vulnerability disclosure paxswill eve ship replacement program user information api.py version 0.12.11 information disclosure vulnerability manipulation remote upgrade patch vdb-220211

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.3

Confidence

High

EPSS

0.001

Percentile

32.4%

JSON

A vulnerability was found in paxswill EVE Ship Replacement Program 0.12.11. It has been rated as problematic. This issue affects some unknown processing of the file src/evesrp/views/api.py of the component User Information Handler. The manipulation leads to information disclosure. The attack may be initiated remotely. Upgrading to version 0.12.12 is able to address this issue. The patch is named 9e03f68e46e85ca9c9694a6971859b3ee66f0240. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220211.

CNA Affected

[
  {
    "vendor": "paxswill",
    "product": "EVE Ship Replacement Program",
    "versions": [
      {
        "version": "0.12.11",
        "status": "affected"
      }
    ],
    "modules": [
      "User Information Handler"
    ]
  }
]

References

github.com/paxswill/evesrp/commit/9e03f68e46e85ca9c9694a6971859b3ee66f0240

github.com/paxswill/evesrp/releases/tag/v0.12.12

vuldb.com/?ctiid.220211

vuldb.com/?id.220211

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

AI Score

4.3

Confidence

High

EPSS

0.001

Percentile

32.4%

JSON

Related for CVELIST:CVE-2020-36660