PT-2020-15031 · Apache · Pulsar Manager

Published 2020-12-18 · Updated 2021-07-21 · CVE-2020-17520

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Pulsar manager version 0.1.0

Description The issue allows malicious users to bypass the admin permission verification mechanism in Pulsar manager by constructing special URLs, thereby accessing any HTTP API.

Recommendations For Pulsar manager version 0.1.0, consider restricting access to HTTP APIs until a patch is available. As a temporary workaround, monitor API requests for suspicious activity and limit URL construction capabilities to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2020-17520

Affected Products

Pulsar Manager

References · 4

• https://osv.dev/vulnerability/CVE-2020-17520 · Vendor Advisory
• https://lists.apache.org/thread.html/rb8b3025f8b507dec0b66791df408cdaf2d155866db1c7a1a4bc621cd%40%3Cdev.pulsar.apache.org%3E · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-17520 · Security Note
• https://t.me/cvenotify/7542 · Telegram Post