CVE-2020-13134 - CVE House
Back to Database
Status published Medium CVE-2020-13134

Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are...

Vulnerability Description

Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are vulnerable to stored XSS. The successful exploitation requires admin privileges (for storing the XSS payload itself), and can exploit (be triggered by) admin users. All TOS versions with SecureChange deployments prior to R19.3 HF3 and R20-1 HF1 are affected. Vulnerabilities were fixed in R19.3 HF3 and R20-1 HF1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-13134

Credits & Attribution

No credits recorded in the NVD database.

References

More from tufin

View All →
CVE-2020-13462
Insecure Direct Object Reference (IDOR) exists in Tufin SecureChange, affecting...
Medium 5.7
CVE-2020-13461
Username enumeration in present in Tufin SecureTrack. It's affecting all...
Medium 4.3
CVE-2020-13460
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities were present in Tufin...
High 8.8
CVE-2020-13409
Tufin SecureTrack < R20-2 GA contains reflected + stored XSS...
Medium 5.9
CVE-2020-13408
Tufin SecureTrack < R20-2 GA contains reflected + stored XSS...
Medium 5.9

Affected Vendor

Affected Software

securechange
Vulnerable Versions:
0, r19-3, r20-1

Timeline

Official Publish: January 20th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.