CVE-2020-6165
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2020-6165
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
SilverStripe 4.5.0 allows attackers to read certain records that should not have been placed into a result set. This affects silverstripe/recipe-cms. The automatic permission-checking mechanism in the silverstripe/graphql module does not provide complete protection against lists that are limited (e.g., through pagination), resulting in records that should have failed a permission check being added to the final result set. GraphQL endpoints are configured by default (e.g., for assets), but the admin/graphql endpoint is access protected by default. This limits the vulnerability to all authenticated users, including those with limited permissions (e.g., where viewing records exposed through admin/graphql requires administrator permissions). However, if custom GraphQL endpoints have been configured for a specific implementation (usually under /graphql), this vulnerability could also be exploited through unauthenticated requests. This vulnerability only applies to reading records; it does not allow unauthorised changing of records.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
SilverStripe 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SilverStripe是新西兰SilverStripe公司的一套开源的编程框架和内容管理系统 (CMS)。该系统具有支持多国语言、跨平台等特点。 SilverStripe 4.5.0版本中存在安全漏洞，该漏洞源于silverstripe/graphql模块中的自动权限检查机制没有对被限制的列表进行充分地安全保护。攻击者可利用该漏洞获取信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
II. Public POCs for CVE-2020-6165
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2020-6165
请登录查看更多情报信息。
Same Patch Batch · n/a · 2020-07-15 · 45 CVEs total
| CVE-2020-15695 | Joomla! 跨站请求伪造漏洞 | |
| CVE-2020-4100 | HCL Verse 安全漏洞 | |
| CVE-2020-13923 | Apache OFBiz 输入验证错误漏洞 | |
| CVE-2020-14511 | Moxa EDR-G902和EDR-G903 缓冲区错误漏洞 | |
| CVE-2020-14503 | Advantech iView 输入验证错误漏洞 | |
| CVE-2020-14499 | Advantech Iview 安全漏洞 | |
| CVE-2020-14505 | Advantech iView 命令注入漏洞 | |
| CVE-2020-14497 | Advantech iView SQL注入漏洞 | |
| CVE-2020-14507 | Advantech iView 路径遍历漏洞 | |
| CVE-2020-14501 | Advantech iView 访问控制错误漏洞 | |
| CVE-2020-9496 | Apache OFBiz 代码问题漏洞 | |
| CVE-2020-15696 | Joomla! 跨站脚本漏洞 | |
| CVE-2020-15697 | Joomla! 安全漏洞 | |
| CVE-2020-15698 | Joomla! 信息泄露漏洞 | |
| CVE-2020-15699 | Joomla! 数据伪造问题漏洞 | |
| CVE-2020-15700 | Joomla! 跨站请求伪造漏洞 | |
| CVE-2020-15572 | The Onion Router 缓冲区错误漏洞 | |
| CVE-2020-8203 | lodash 输入验证错误漏洞 | |
| CVE-2020-8178 | npm jison 操作系统命令注入漏洞 | |
| CVE-2019-19326 | SilverStripe 环境问题漏洞 |
Showing top 20 of 45 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2020-6165
No comments yet