CVE Vulnerability

CVE-2020-10590

Replicated Classic 2.x versions have an improperly secured API that exposes sensitive data from the Replicated Admin Console configuration. An attacker with network access to the Admin Console port (8800) on the Replicated Classic server could retrieve the TLS Keypair (Cert and Key) used to configure the Admin Console.

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

7.5 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://gradle.com/enterprise/releases/2019.5/#changes Third Party Advisory
https://www.replicated.com/security/advisories/CVE-2020-10590 Vendor Advisory
https://blog.replicated.com Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:replicated:replicated_classic:*:*:*:*:*:*:*:*
cpe:2.3:a:replicated:replicated_classic:*:*:*:*:*:*:*:*
cpe:2.3:a:replicated:replicated_classic:*:*:*:*:*:*:*:*
cpe:2.3:a:replicated:replicated_classic:*:*:*:*:*:*:*:*
cpe:2.3:a:replicated:replicated_classic:*:*:*:*:*:*:*:*
cpe:2.3:a:replicated:replicated_classic:*:*:*:*:*:*:*:*
cpe:2.3:a:replicated:replicated_classic:*:*:*:*:*:*:*:*
cpe:2.3:a:replicated:replicated_classic:2.41.0:*:*:*:*:*:*:*
Information

Published : 2021-07-30 02:15

Updated : 2022-06-28 02:11

NVD link : CVE-2020-10590

Mitre link : CVE-2020-10590

Products Affected
No products.
CWE
NVD-CWE-noinfo