nvd-json-data-feeds/CVE-2020/CVE-2020-105xx/CVE-2020-10590.json

{
  "id": "CVE-2020-10590",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2021-07-30T14:15:12.930",
  "lastModified": "2022-06-28T14:11:45.273",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "Replicated Classic 2.x versions have an improperly secured API that exposes sensitive data from the Replicated Admin Console configuration. An attacker with network access to the Admin Console port (8800) on the Replicated Classic server could retrieve the TLS Keypair (Cert and Key) used to configure the Admin Console."
    },
    {
      "lang": "es",
      "value": "Replicated Classic versiones 2.x, presentan una API asegurada inapropiadamente que expone datos confidenciales de la configuraci\u00f3n de la Consola de Administraci\u00f3n Replicada. Un atacante con acceso de red al puerto de la Consola de Administraci\u00f3n (8800) en el servidor de Replicated Classic podr\u00eda recuperar el par de claves TLS (Cert y Key) usado para configurar la Consola de Administraci\u00f3n"
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "NONE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.0
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 10.0,
        "impactScore": 2.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:replicated:replicated_classic:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.10.0",
              "versionEndIncluding": "2.32.3",
              "matchCriteriaId": "A13F1249-8DFC-4CCB-8E39-5237958CA278"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:replicated:replicated_classic:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.33.0",
              "versionEndIncluding": "2.36.0",
              "matchCriteriaId": "EAD962E0-AD59-45C2-9AA2-825CD1589522"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:replicated:replicated_classic:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.37.0",
              "versionEndIncluding": "2.37.1",
              "matchCriteriaId": "10023122-0F02-4D4A-B413-5227EE939BB7"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:replicated:replicated_classic:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.38.0",
              "versionEndIncluding": "2.38.5",
              "matchCriteriaId": "ADFC23B4-835F-4ACC-91E2-76752F14E7A3"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:replicated:replicated_classic:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.39.0",
              "versionEndIncluding": "2.39.3",
              "matchCriteriaId": "10D63E7B-B00E-4F2B-AF6D-DAA6EAC614F9"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:replicated:replicated_classic:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.40.0",
              "versionEndIncluding": "2.40.3",
              "matchCriteriaId": "8EC5AF21-62BD-4883-8941-7690D7EEF64F"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:replicated:replicated_classic:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.42.0",
              "versionEndIncluding": "2.42.3",
              "matchCriteriaId": "304928C9-4462-43C1-99E3-7C01101E4DAB"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:replicated:replicated_classic:2.41.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "0350B1B8-C397-4CE1-B9E7-73D93B80DA6B"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://blog.replicated.com",
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://gradle.com/enterprise/releases/2019.5/#changes",
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.replicated.com/security/advisories/CVE-2020-10590",
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}