Lucene search

MitreCVE-2020-13134

HistoryJan 20, 2021 - 2:15 a.m.

CVE-2020-13134

2021-01-2002:15:13

CWE-79

mitre

web.nvd.nist.gov

tufin

securechange

r19.3 hf3

r20-1 hf1

stored xss

admin privileges

vulnerability

nvd

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

AI Score

4.9

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are vulnerable to stored XSS. The successful exploitation requires admin privileges (for storing the XSS payload itself), and can exploit (be triggered by) admin users. All TOS versions with SecureChange deployments prior to R19.3 HF3 and R20-1 HF1 are affected. Vulnerabilities were fixed in R19.3 HF3 and R20-1 HF1.

Affected configurations

Nvd

Node

tufinsecurechangeRange<r19-3

tufinsecurechangeMatchr19-3-

tufinsecurechangeMatchr20-1-

VendorProductVersionCPE
tufinsecurechange*cpe:2.3:a:tufin:securechange:*:*:*:*:*:*:*:*
tufinsecurechanger19-3cpe:2.3:a:tufin:securechange:r19-3:-:*:*:*:*:*:*
tufinsecurechanger20-1cpe:2.3:a:tufin:securechange:r20-1:-:*:*:*:*:*:*

Vendor	Product	Version	CPE
tufin	securechange	*	cpe:2.3:a:tufin:securechange::::::::
tufin	securechange	r19-3	cpe:2.3:a:tufin:securechange:r19-3:-::::::
tufin	securechange	r20-1	cpe:2.3:a:tufin:securechange:r20-1:-::::::

References

github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md

portal.tufin.com/aspx/SecurityAdvisories

Social References

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

AI Score

4.9

Confidence

High

EPSS

0.001

Percentile

22.7%

JSON

Related for CVE-2020-13134