CVE-2020-29031CWE-280

Insecure Direct Object Reference in GateManager WebUI can cause privilege escalation

High · published February 15, 2021

CVSS v3.1
7.1
EPSS
1%
Percentile
54.3
In the wild
Unconfirmed
What it is

An Insecure Direct Object Reference vulnerability exists in the web UI of the GateManager which allows an authenticated attacker to reset the password of any user in its domain or any sub-domain, via escalation of privileges. This issue affects all GateManager versions prior to 9.2c

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00747 · 54.3th percentile
Weakness
CWE-280 · Improper Handling of Insufficient Permissions or Privileges
Published
2021-02-15T15:52Z
EPSS history
Timeline
  • 15 FEB 15:52Z
    Insecure Direct Object Reference in GateManager WebUI can cause privilege escalation
    cvelistv5