CVE-2020-35586

In Solstice Pod before 3.3.0 (or Open4.3), the Administrator password can be enumerated using brute-force attacks via the /Config/service/initModel?password=…

published December 23, 2020

CVSS
—
EPSS
1%
Percentile
71.7
In the wild
Unconfirmed
What it is

In Solstice Pod before 3.3.0 (or Open4.3), the Administrator password can be enumerated using brute-force attacks via the /Config/service/initModel?password= Solstice Open Control API because there is no complexity requirement (e.g., it might be all digits or all lowercase letters).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01369 · 71.7th percentile
Published
2020-12-23T14:58Z
EPSS history
Timeline
  • 23 DEC 14:58Z
    In Solstice Pod before 3.3.0 (or Open4.3), the Administrator password can be enumerated using brute-force attacks via the /Config/service/initModel?password=…
    cvelistv5