PT-2020-13374 · Teradici · Teradici Cloud Access Connector

Published 2020-08-11 · Updated 2020-08-14 · CVE-2020-13175

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Teradici Cloud Access Connector versions prior to 15 Teradici Cloud Access Connector Legacy versions prior to April 20, 2020

Description The issue allows an unauthenticated remote attacker to leak LDAP credentials via a specially crafted HTTP request. This is due to a local file inclusion vulnerability in the Management Interface of the affected software.

Recommendations For Teradici Cloud Access Connector versions prior to 15, update to a version released after April 20, 2020. For Teradici Cloud Access Connector Legacy versions prior to April 20, 2020, update to a version released after April 20, 2020.

Fix

Weakness Enumeration

CWE-829

CWE-98

Related Identifiers

CVE-2020-13175

Affected Products

Teradici Cloud Access Connector

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2020-13175 · Security Note
• https://osv.dev/vulnerability/CVE-2020-13175 · Vendor Advisory
• https://advisory.teradici.com/security-advisories/59 · Vendor Advisory
• https://t.me/cibsecurity/14050 · Telegram Post