PT-2020-16333 · Tangro · Tangro Business Workflow

Published 2020-12-18 · Updated 2020-12-21 · CVE-2020-26178

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions tangro Business Workflow versions prior to 1.18.1

Description The issue allows unauthorized access to download workitem attachments by knowing the attachment ID, without requiring authentication.

Recommendations For versions prior to 1.18.1, update to version 1.18.1 or later to resolve the issue.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2020-26178

Affected Products

Tangro Business Workflow

References · 6

• 🔥 https://blog.to.com/advisory-tangro-bwf-1-17-5-multiple-vulnerabilities · Exploit
• https://osv.dev/vulnerability/CVE-2020-26178 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26178 · Security Note
• https://tangro.de · Note
• https://t.me/cvenotify/7328 · Telegram Post
• https://t.me/cvenotify/7452 · Telegram Post