PT-2020-10611 · Intland · Codebeamer

Published 2020-04-02 · Updated 2020-08-24 · CVE-2019-20635

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions codeBeamer versions prior to 9.5.0-RC3

Description The issue is related to the ability to execute custom Java code and access the Java class loader via computed fields. This is due to improper restrictions in the software.

Recommendations For versions prior to 9.5.0-RC3, update to version 9.5.0-RC3 or later to resolve the issue. As a temporary workaround, consider restricting access to computed fields to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-470

Related Identifiers

CVE-2019-20635

Affected Products

Codebeamer

References · 5

• https://codebeamer.com/cb/wiki/7372223 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-20635 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-20635 · Security Note
• https://t.me/cibsecurity/10947 · Telegram Post
• https://t.me/cvenotify/2365 · Telegram Post