CVE-2020-13176

The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 24, 2020 (v16 and earlier for the Cloud Access Connector) contains a stored cross-site scripting (XSS) vulnerability which allows a remote unauthenticated attacker to poison log files with malicious JavaScript via the login page which is executed when an administrator views the logs within the application.

CVSS v3 6.1 MEDIUM
CVSS v2.0 4.3 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://advisory.teradici.com/security-advisories/59/	Vendor Advisory
https://advisory.teradici.com/security-advisories/59/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:teradici:cloud_access_connector::::::::
	cpe:2.3:a:teradici:cloud_access_connector_legacy::::::::

History

21 Nov 2024, 05:00

Type	Values Removed	Values Added
References	~~() https://advisory.teradici.com/security-advisories/59/ - Vendor Advisory~~	() https://advisory.teradici.com/security-advisories/59/ - Vendor Advisory

Information

Published : 2020-08-11 18:15

Updated : 2024-11-21 05:00

NVD link : CVE-2020-13176

Mitre link : CVE-2020-13176

CVE.ORG link : CVE-2020-13176

JSON object : View

Products Affected

teradici

cloud_access_connector
cloud_access_connector_legacy

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2020-13176", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "published": "2020-08-11T18:15:12.597", "references": [{"url": "https://advisory.teradici.com/security-advisories/59/", "tags": ["Vendor Advisory"], "source": "security@teradici.com"}, {"url": "https://advisory.teradici.com/security-advisories/59/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@teradici.com", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 24, 2020 (v16 and earlier for the Cloud Access Connector) contains a stored cross-site scripting (XSS) vulnerability which allows a remote unauthenticated attacker to poison log files with malicious JavaScript via the login page which is executed when an administrator views the logs within the application."}, {"lang": "es", "value": "La interfaz de administraci\u00f3n de Teradici Cloud Access Connector y Cloud Access Connector Legacy para versiones anteriores al 24 de abril de 2020 (versi\u00f3n v16 y anteriores para Cloud Access Connector), contiene una vulnerabilidad de tipo cross-site scripting (XSS) almacenado que permite a un atacante remoto no autenticado envenenar archivos de registro con JavaScript malicioso por medio de la p\u00e1gina de inicio de sesi\u00f3n que es ejecutada cuando un administrador visualiza los registros dentro de la aplicaci\u00f3n"}], "lastModified": "2024-11-21T05:00:48.497", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:teradici:cloud_access_connector:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "45CE67C9-CBA1-4D2E-86B5-A8FAECD7660F", "versionEndIncluding": "16"}, {"criteria": "cpe:2.3:a:teradici:cloud_access_connector_legacy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64CA198C-E7E8-4485-A137-C02404C99685", "versionEndExcluding": "2020-04-24"}], "operator": "OR"}]}], "sourceIdentifier": "security@teradici.com"}