CVE-2020-26178

In tangro Business Workflow before 1.18.1, knowing an attachment ID, it is possible to download workitem attachments without being authenticated

Medium · published December 18, 2020

CVSS v3.1
5.3
EPSS
1%
Percentile
59.2
In the wild
Unconfirmed
What it is

In tangro Business Workflow before 1.18.1, knowing an attachment ID, it is possible to download workitem attachments without being authenticated.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AC:L/AV:N/A:N/C:L/I:N/PR:N/S:U/UI:N
CVSS v4.0
Not supplied
EPSS
0.00897 · 59.2th percentile
Published
2020-12-18T09:26Z
EPSS history
Timeline
  • 18 DEC 09:26Z
    In tangro Business Workflow before 1.18.1, knowing an attachment ID, it is possible to download workitem attachments without being authenticated
    cvelistv5