CVE-2020-13407 - CVE House
Back to Database
Status published Medium CVE-2020-13407

Tufin SecureTrack < R20-2 GA contains reflected + stored XSS...

Vulnerability Description

Tufin SecureTrack < R20-2 GA contains reflected + stored XSS (as in, the value is reflected back to the user, but is also stored within the DB and can be later triggered again by the same victim, or also later by different users). Both stored, and reflected payloads are triggerable by admin, so malicious non-authenticated user could get admin level access. Even malicious low-privileged user can inject XSS, which can be executed by admin, potentially elevating privileges and obtaining admin access. (issue 1 of 3)

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-13407

Credits & Attribution

No credits recorded in the NVD database.

References

More from tufin

View All →
CVE-2020-13462
Insecure Direct Object Reference (IDOR) exists in Tufin SecureChange, affecting...
Medium 5.7
CVE-2020-13461
Username enumeration in present in Tufin SecureTrack. It's affecting all...
Medium 4.3
CVE-2020-13460
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities were present in Tufin...
High 8.8
CVE-2020-13409
Tufin SecureTrack < R20-2 GA contains reflected + stored XSS...
Medium 5.9
CVE-2020-13408
Tufin SecureTrack < R20-2 GA contains reflected + stored XSS...
Medium 5.9

Affected Vendor

Affected Software

securetrack
Vulnerable Versions:
0

Timeline

Official Publish: February 9th, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.