PT-2020-16452 · Aviatrix · Aviatrix Controller

Published 2020-11-17 · Updated 2020-12-09 · CVE-2020-26549

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Aviatrix Controller versions prior to R5.4.1290

Description An issue was discovered in the Aviatrix Controller where the htaccess protection mechanism, designed to prevent requests to directories, can be bypassed for file downloading.

Recommendations For versions prior to R5.4.1290, update to version R5.4.1290 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive directories to minimize the risk of exploitation.

Exploit

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2020-26549

Affected Products

Aviatrix Controller

References · 6

• 🔥 https://criticalstart.com/multiple-vulnerabilities-discovered-in-aviatrix · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-26549 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26549 · Vendor Advisory
• https://t.me/cibsecurity/17366 · Telegram Post
• https://t.me/cibsecurity/16482 · Telegram Post
• https://t.me/cvenotify/5746 · Telegram Post