PT-2020-16427 · Marmind · Marmind

Published 2020-11-05 · Updated 2021-07-21 · CVE-2020-26506

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Marmind web application version 4.1.141.0

Description The issue allows users with lower privileges to bypass authorization and access files uploaded by administrative users, which are not visible to them in the web GUI.

Recommendations For version 4.1.141.0, update to a newer version that contains a fix for this issue, however, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Weakness Enumeration

CWE-863

CWE-670

Related Identifiers

CVE-2020-26506

Affected Products

Marmind

References · 4

• 🔥 https://www2.deloitte.com/de/de/pages/risk/articles/marmind-authorization-bypass.html · Exploit
• https://osv.dev/vulnerability/CVE-2020-26506 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26506 · Security Note
• https://marmind.com/en · Note