Sensitive Data Exposure in Replicated Classic 2.x API by Replicated
CVE-2020-10590

7.5HIGH

Key Information:

Vendor

Replicated

Status
Replicated Classic
Vendor
CVE Published:
30 July 2021

What is CVE-2020-10590?

Replicated Classic versions 2.x contain an API that is improperly secured, allowing unauthorized access to sensitive configuration information from the Admin Console. Attackers with network access to the Admin Console's designated port (8800) can retrieve critical components such as the TLS Keypair (certificate and key) used for securing communications. This vulnerability highlights the importance of securing API endpoints to prevent unauthorized data access and potential exploitation.

References

https://blog.replicated.com
x_refsource_MISC
https://gradle.com/enterprise/releases/2019.5/#changes
x_refsource_CONFIRM
https://www.replicated.com/security/advisories/CVE-2020-1...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.