CVE-2020-13414

CVE-2020-13414 affects Aviatrix Controller prior to 5.4.1204. The issue is an information disclosure vulnerability described as credentials unused by the software. NVD metrics list CVSSv3.1 base score 7.5 (HIGH) with network access and low exploit complexity; confidentiality impact HIGH, others N...

CVE-2020-13415

CVE-2020-13415: Multiple records describe an XML Signature Wrapping vulnerability in Aviatrix Controller (v5.1 and earlier). An attacker with any signed SAML assertion from the IdP can establish a connection, even if the assertion is expired or the user is not authorized. This indicates a weaknes...

CVE-2020-26552

Summary: CVE-2020-26552 affects Aviatrix Controller prior to R6.0.2483. The issue is improper access control: multiple API-endpoint executables do not require a valid session ID, enabling potential account takeover. Affected software: Aviatrix Controller (pre-R6.0.2483). Root cause: insufficient ...

CVE-2020-26549

CVE-2020-26549 affects Aviatrix Controller prior to R5.4.1290. The vulnerability arises from an htaccess protection mechanism that prevents requests to directories, which can be bypassed to download files beyond a user’s rights. Documented impact in CNVD/NVD entries: an attacker could download re...

CVE-2020-26551

Aviatrix Controller before R5.3.1151 stores encrypted key values in a readable file, exposing plaintext encryption keys. CNVD-2021-17719 and NVD records confirm plaintext key storage prior to R5.3.1151; risk is confidentiality impact (high per CVSS3.1). Remediation: upgrade to R5.3.1151 or later ...

CVE-2020-26550

CVE-2020-26550 pertains to Aviatrix Controller prior to R5.3.1151, where an encrypted file containing credentials is protected by a three-character key. The root cause is a weak key in the encrypted file, which has implications for confidentiality (HIGH per CVSS3.1). The connected documents confi...

CVE-2020-27568

The CVE-2020-27568 entry concerns Aviatrix Controller 5.3.1516 with insecure file permissions. The issue is caused by the presence of world-writable files and directories in the controller resource, as noted in multiple sources. The information provided does not include specific vulnerable compon...