PT-2020-14301 · Ractf · Ractf

0Xada + 3 · Published 2020-10-05 · Updated 2020-10-19 · CVE-2020-15235

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions RACTF versions prior to commit f3dc89b

Description The issue allows unauthenticated users to access sensitive config keys that are normally hidden from everyone except admins.

Recommendations For versions prior to commit f3dc89b, update to a version after commit f3dc89b to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2020-15235

GHSA-PH67-C355-52VM

Affected Products

Ractf

References · 5

• https://github.com/ractf/core/security/advisories/GHSA-ph67-c355-52vm · Vendor Advisory
• https://github.com/ractf/core/commit/f3dc89b9f6ab1544a289b3efc06699b13d63e0bd · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-15235 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-15235 · Security Note
• https://t.me/cibsecurity/15058 · Telegram Post