CVE-2020-2500
published 2020-07-01CVE-2020-2500: This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensitive data on QNAP…
PriorityP336medium6.5CVSS 3.1
AVNACLPRNUINSUCLILAN
EPSS
0.74%
50.9th percentile
This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensitive data on QNAP Kayako server with API keys. We have replaced the API key to mitigate the vulnerability, and already fixed the issue in Helpdesk 3.0.1 and later versions.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | vapor_vapor | >= 4.0.0-rc.2.5 < 4.29.4 | 4.29.4 |
| qnap | helpdesk | < 3.0.1 | 3.0.1 |
| qnap_systems_inc | helpdesk | >= unspecified < 3.0.1 | 3.0.1 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Arbitrary file read using percent-encoded relative paths in FileMiddleware
ghsa·2023-06-09
CVE-2020-15230 [MEDIUM] CWE-22 Arbitrary file read using percent-encoded relative paths in FileMiddleware
Arbitrary file read using percent-encoded relative paths in FileMiddleware
### Impact
Attackers can access data at arbitrary filesystem paths on the same host as an application using `FileMiddleware`.
### Patches
Version [4.29.4](https://github.com/vapor/vapor/releases/tag/4.29.4)
### Workarounds
Upgrade to 4.24.4 or later, or disable `FileMiddleware`.
### References
* Introduced in https://github.com/vapor/vapor/pull/2223
* Fixed by https://github.com/vapor/vapor/pull/2500
### For more information
If you have any questions or comments about this advisory:
* Open [an issue](https://github.com/vapor/vapor/issues)
* Email us at [[email protected]](mailto:[email protected])
GHSA
GHSA-v7p7-qff5-5j8w: This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service
ghsa_unreviewed·2022-05-24
CVE-2020-2500 [MEDIUM] GHSA-v7p7-qff5-5j8w: This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service
This improper access control vulnerability in Helpdesk allows attackers to get control of QNAP Kayako service. Attackers can access the sensitive data on QNAP Kayako server with API keys. We have replaced the API key to mitigate the vulnerability, and already fixed the issue in Helpdesk 3.0.1 and later versions.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-07-01
Published