PT-2020-13375 · Teradici · Teradici Cloud Access Connector+1

Published 2020-08-11 · Updated 2020-08-13 · CVE-2020-13176

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Teradici Cloud Access Connector versions prior to 16 Teradici Cloud Access Connector Legacy versions prior to April 24, 2020

Description The Management Interface contains a stored cross-site scripting (XSS) issue, allowing a remote unauthenticated attacker to inject malicious JavaScript into log files via the login page. This malicious code is executed when an administrator views the logs within the application.

Recommendations For Teradici Cloud Access Connector versions prior to 16, update to a version released after April 24, 2020. For Teradici Cloud Access Connector Legacy, consider restricting access to the Management Interface until a fix is applied. As a temporary workaround, consider limiting administrator log viewing to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-13176

Affected Products

Teradici Cloud Access Connector

Teradici Cloud Access Connector Legacy

References · 4

• https://osv.dev/vulnerability/CVE-2020-13176 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-13176 · Security Note
• https://advisory.teradici.com/security-advisories/59 · Vendor Advisory
• https://t.me/cibsecurity/14049 · Telegram Post