Vulnerability Details : CVE-2020-9300
The Access Control issues include allowing a regular user to view a restricted incident, user role escalation to admin, users adding themselves as a participant in a restricted incident, and users able to view restricted incidents via the search feature. If your install has followed the secure deployment guidelines the risk of this is lowered, as this may only be exploited by an authenticated user.
Products affected by CVE-2020-9300
- cpe:2.3:a:netflix:dispatch:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-9300
0.62%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 69 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-9300
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.0
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:N/A:N |
8.0
|
2.9
|
NIST | |
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
2.8
|
3.6
|
NIST |
References for CVE-2020-9300
-
https://github.com/Netflix/dispatch/releases/tag/v20201106
Release Release v20201106 · Netflix/dispatch · GitHubThird Party Advisory
-
https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-005.md
security-bulletins/nflx-2020-005.md at master · Netflix/security-bulletins · GitHubThird Party Advisory
Jump to