CVE-2020-15391

2020-07-2320:15:11

Google

osv.dev

8.1 High

AI Score

Confidence

Low

0.01 Low

EPSS

Percentile

83.5%

JSON

The UI in DevSpace 4.13.0 allows web sites to execute actions on pods (on behalf of a victim) because of a lack of authentication for the WebSocket protocol. This leads to remote code execution.

CPENameOperatorVersion
devspaceeq4.12.0
devspaceeq4.12.2
devspaceeq3.2.1
devspaceeq3.5.8
devspaceeq4.4.0
devspaceeq4.6.0-beta.2
devspaceeq0.0.2
devspaceeq2.0.4
devspaceeq4.3.0
devspaceeq0.1.1

Name	Operator	Version
devspace	eq	4.12.0
devspace	eq	4.12.2
devspace	eq	3.2.1
devspace	eq	3.5.8
devspace	eq	4.4.0
devspace	eq	4.6.0-beta.2
devspace	eq	0.0.2
devspace	eq	2.0.4
devspace	eq	4.3.0
devspace	eq	0.1.1