diff --git a/2020/15xxx/CVE-2020-15822.json b/2020/15xxx/CVE-2020-15822.json index c59d5a8253b..fd4f444809f 100644 --- a/2020/15xxx/CVE-2020-15822.json +++ b/2020/15xxx/CVE-2020-15822.json @@ -1,17 +1,66 @@ { - "data_type": "CVE", - "data_format": "MITRE", - "data_version": "4.0", "CVE_data_meta": { - "ID": "CVE-2020-15822", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "ID": "CVE-2020-15822", + "STATE": "PUBLIC" }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "data_format": "MITRE", + "data_type": "CVE", + "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "In JetBrains YouTrack before 2020.2.10514, SSRF is possible because URL filtering can be escaped." + } + ] + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "url": "https://blog.jetbrains.com", + "refsource": "MISC", + "name": "https://blog.jetbrains.com" + }, + { + "refsource": "CONFIRM", + "name": "https://blog.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020/", + "url": "https://blog.jetbrains.com/blog/2020/08/06/jetbrains-security-bulletin-q2-2020/" } ] } diff --git a/2020/15xxx/CVE-2020-15909.json b/2020/15xxx/CVE-2020-15909.json index 98661ef59d7..a4922e5898c 100644 --- a/2020/15xxx/CVE-2020-15909.json +++ b/2020/15xxx/CVE-2020-15909.json @@ -34,7 +34,7 @@ "description_data": [ { "lang": "eng", - "value": "SolarWinds N-central through 2020.1 allows session hijacking." + "value": "SolarWinds N-central through 2020.1 allows session hijacking and requires user interaction or physical access. The N-Central JSESSIONID cookie attribute is not checked against multiple sources such as sourceip, MFA claim, etc. as long as the victim stays logged in within N-Central. To take advantage of this, cookie could be stolen and the JSESSIONID can be captured. On its own this is not a surprising result; low security tools allow the cookie to roam from machine to machine. The JSESSION cookie can then be used on the attackers\u2019 workstation by browsing to the victim\u2019s NCentral server URL and replacing the JSESSIONID attribute value by the captured value. Expected behavior would be to check this against a second source and enforce at least a reauthentication or multi factor request as N-Central is a highly privileged service." } ] }, diff --git a/2020/15xxx/CVE-2020-15910.json b/2020/15xxx/CVE-2020-15910.json index 11134366a91..65b003e8162 100644 --- a/2020/15xxx/CVE-2020-15910.json +++ b/2020/15xxx/CVE-2020-15910.json @@ -34,7 +34,7 @@ "description_data": [ { "lang": "eng", - "value": "SolarWinds N-central through 12.3 does not include the HTTPOnly flag in the Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie." + "value": "SolarWinds N-Central version 12.3 GA and lower does not set the JSESSIONID attribute to HTTPOnly. This makes it possible to influence the cookie with javascript. An attacker could send the user to a prepared webpage or by influencing JavaScript to the extract the JESSIONID. This could then be forwarded to the attacker." } ] }, diff --git a/2020/24xxx/CVE-2020-24375.json b/2020/24xxx/CVE-2020-24375.json index d9fc53e4547..fb59827a121 100644 --- a/2020/24xxx/CVE-2020-24375.json +++ b/2020/24xxx/CVE-2020-24375.json @@ -5,13 +5,62 @@ "CVE_data_meta": { "ID": "CVE-2020-24375", "ASSIGNER": "cve@mitre.org", - "STATE": "RESERVED" + "STATE": "PUBLIC" + }, + "affects": { + "vendor": { + "vendor_data": [ + { + "product": { + "product_data": [ + { + "product_name": "n/a", + "version": { + "version_data": [ + { + "version_value": "n/a" + } + ] + } + } + ] + }, + "vendor_name": "n/a" + } + ] + } + }, + "problemtype": { + "problemtype_data": [ + { + "description": [ + { + "lang": "eng", + "value": "n/a" + } + ] + } + ] + }, + "references": { + "reference_data": [ + { + "refsource": "CONFIRM", + "name": "https://dev.freebox.fr/blog/?p=10222", + "url": "https://dev.freebox.fr/blog/?p=10222" + }, + { + "refsource": "MISC", + "name": "https://www.gabriel.urdhr.fr/2020/09/23/dns-rebinding-freebox/", + "url": "https://www.gabriel.urdhr.fr/2020/09/23/dns-rebinding-freebox/" + } + ] }, "description": { "description_data": [ { "lang": "eng", - "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value": "A DNS rebinding vulnerability in the UPnP MediaServer implementation in Freebox Server before 4.2.3." } ] } diff --git a/2020/5xxx/CVE-2020-5398.json b/2020/5xxx/CVE-2020-5398.json index 3ca4076480c..ef89c113453 100644 --- a/2020/5xxx/CVE-2020-5398.json +++ b/2020/5xxx/CVE-2020-5398.json @@ -223,6 +223,11 @@ "refsource": "MLIST", "name": "[ambari-dev] 20201019 [GitHub] [ambari] dlysnichenko merged pull request #3246: AMBARI-25571. Vulnerable Spring components in Ambari - CVE-2020-5398, CVE-2020-5421", "url": "https://lists.apache.org/thread.html/r8b496b1743d128e6861ee0ed3c3c48cc56c505b38f84fa5baf7ae33a@%3Cdev.ambari.apache.org%3E" + }, + { + "refsource": "MLIST", + "name": "[ambari-commits] 20201019 [ambari] branch branch-2.7 updated: AMBARI-25571. Vulnerable Spring components in Ambari - CVE-2020-5398, CVE-2020-5421 (dlysnichenko) (#3246)", + "url": "https://lists.apache.org/thread.html/r1c679c43fa4f7846d748a937955c7921436d1b315445978254442163@%3Ccommits.ambari.apache.org%3E" } ] },