CVE-2020-29022 : Failure to Sanitize host header value on output in the GateManager Web server co

Failure to Sanitize host header value on output in the GateManager Web server could allow an attacker to conduct web cache poisoning attacks. This issue affects Secomea GateManager all versions prior to 9.3

Published 2021-02-16 16:15:13

Updated 2021-02-26 18:58:56

Source Secomea A/S

View at NVD, CVE.org

Products affected by CVE-2020-29022

Secomea » Gatemanager 8250 Firmware
Versions before (<) 9.3
cpe:2.3:o:secomea:gatemanager_8250_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Secomea » Gatemanager 8250 » Version: N/A
Secomea » Gatemanager 4250 Firmware
cpe:2.3:o:secomea:gatemanager_4250_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Secomea » Gatemanager 4250 » Version: N/A
Secomea » Gatemanager 4260 Firmware
cpe:2.3:o:secomea:gatemanager_4260_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Secomea » Gatemanager 4260 » Version: N/A
Secomea » Gatemanager 9250 Firmware
cpe:2.3:o:secomea:gatemanager_9250_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Secomea » Gatemanager 9250 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2020-29022

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 35 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-29022

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:N	10.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
5.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	3.9	1.4	Secomea A/S
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2020-29022

CWE-159 Improper Handling of Invalid Use of Special Elements

The product does not properly filter, remove, quote, or otherwise manage the invalid use of special elements in user-controlled input, which could cause adverse effect on its behavior and integrity.

Assigned by: VulnerabilityReporting@secomea.com (Secondary)

References for CVE-2020-29022

https://www.secomea.com/support/cybersecurity-advisory/#2923

Cybersecurity Advisory - Secomea
Vendor Advisory

Jump to

Vulnerability Details : CVE-2020-29022

Products affected by CVE-2020-29022

Exploit prediction scoring system (EPSS) score for CVE-2020-29022

CVSS scores for CVE-2020-29022

CWE ids for CVE-2020-29022

References for CVE-2020-29022