6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
42.8%
This affects Presto server installations. This does NOT affect clients such as the CLI or JDBC driver.
Authenticated users can bypass authorization checks by directly accessing internal APIs. This impacts Presto server installations with secure internal communication configured.
This does not affect installations that have not configured secure internal communication, as these installations are inherently insecure.
This issue has been fixed starting with PrestoSQL version 337.
This issue can be mitigated by blocking network access to internal APIs on the coordinator and workers.
See the Presto documentation for Secure Internal Communication.
If you have any questions or comments about this advisory:
CPE | Name | Operator | Version |
---|---|---|---|
io.prestosql:presto-server | lt | 337 |
github.com/advisories/GHSA-f6pc-crhh-cp96
github.com/prestosql/presto/security/advisories/GHSA-f6pc-crhh-cp96
github.com/trinodb/trino/security/advisories/GHSA-f6pc-crhh-cp96
nvd.nist.gov/vuln/detail/CVE-2020-15087
prestosql.io/docs/current/release/release-337.html#security-changes
trino.io/docs/current/release/release-337.html#security-changes
6.5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
0.001 Low
EPSS
Percentile
42.8%