PT-2020-20575 · Git+1 · Dispatch

Thank_You · Published 2020-11-09 · Updated 2020-11-18 · CVE-2020-9300

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions.

Description The issue involves Access Control problems, including allowing regular users to view restricted incidents, user role escalation to admin, users adding themselves as participants in restricted incidents, and users being able to view restricted incidents via the search feature. The risk of exploitation is lowered if the installation follows secure deployment guidelines, as this can only be exploited by an authenticated user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2020-9300

Affected Products

Dispatch

References · 6

• https://osv.dev/vulnerability/CVE-2020-9300 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-9300 · Security Note
• https://github.com/Netflix/dispatch/releases/tag/v20201106 · Note
• https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-005.md · Note
• https://t.me/cvenotify/5766 · Telegram Post
• https://t.me/cibsecurity/16029 · Telegram Post