CVE-2020-36660 : A vulnerability was found in paxswill EVE Ship Replacement Program 0.12.11. It h

A vulnerability was found in paxswill EVE Ship Replacement Program 0.12.11. It has been rated as problematic. This issue affects some unknown processing of the file src/evesrp/views/api.py of the component User Information Handler. The manipulation leads to information disclosure. The attack may be initiated remotely. Upgrading to version 0.12.12 is able to address this issue. The patch is named 9e03f68e46e85ca9c9694a6971859b3ee66f0240. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-220211.

Published 2023-02-06 17:15:09

Updated 2024-05-17 01:48:55

Source VulDB

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2020-36660

Eve Ship Replacement Program Project » Eve Ship Replacement Program » Version: 0.12.11
cpe:2.3:a:eve_ship_replacement_program_project:eve_ship_replacement_program:0.12.11:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2020-36660

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 32 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-36660

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N	8.0	2.9	VulDB
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
4.0	MEDIUM	AV:N/AC:L/Au:S/C:P/I:N/A:N	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
4.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	2.8	1.4	VulDB
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	2.8	1.4	VulDB
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	2.8	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2020-36660

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: cna@vuldb.com (Secondary)

References for CVE-2020-36660

https://github.com/paxswill/evesrp/commit/9e03f68e46e85ca9c9694a6971859b3ee66f0240

Security Vuln: Check API access to entity details · paxswill/evesrp@9e03f68 · GitHub
Patch
https://vuldb.com/?id.220211

Login required
Third Party Advisory
https://vuldb.com/?ctiid.220211

Login required
Permissions Required;Third Party Advisory
https://github.com/paxswill/evesrp/releases/tag/v0.12.12

Release v0.12.12 · paxswill/evesrp · GitHub
Release Notes

Jump to

Vulnerability Details : CVE-2020-36660

Products affected by CVE-2020-36660

Exploit prediction scoring system (EPSS) score for CVE-2020-36660

CVSS scores for CVE-2020-36660

CWE ids for CVE-2020-36660

References for CVE-2020-36660