PT-2020-14175 · Presto · Presto

Electrum · Published 2020-06-30 · Updated 2022-10-21 · CVE-2020-15087

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Presto versions prior to 337

Description Authenticated users can bypass authorization checks by directly accessing internal APIs. This issue impacts Presto server installations with secure internal communication configured. It does not affect installations without secure internal communication, as they are inherently insecure. This issue only affects Presto server installations and does not affect clients such as the CLI or JDBC driver.

Recommendations For versions prior to 337, update to version 337 or later to resolve the issue. As a temporary workaround, consider blocking network access to internal APIs on the coordinator and workers to mitigate the risk of exploitation.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2020-15087

GHSA-F6PC-CRHH-CP96

Affected Products

Presto

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-15087 · Security Note
• https://trino.io/docs/current/release/release-337.html#security-changes · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f6pc-crhh-cp96 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15087 · Vendor Advisory
• https://github.com/prestosql/presto/security/advisories/GHSA-f6pc-crhh-cp96 · Note
• https://github.com/trinodb/trino/security/advisories/GHSA-f6pc-crhh-cp96 · Note
• https://prestosql.io/docs/current/release/release-337.html#security-changes · Note