CVE-2020-15136: falha de média gravidade em etcd-io etcd
Improper authentication in etcd
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.5epss 1.7%
In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Produtos afetados
etcd-io · etcdCVEs relacionadas — etcd-io etcd
No mesmo produto, das mais perigosas para as menos.
CVE-2020-15115MEDIUMNo minimum password length in etcdEPSS 1.3%CVE-2020-15112MEDIUMImproper Input Validation in etcdEPSS 1.3%CVE-2020-15106MEDIUMImproper Input Validation in etcdEPSS 1.3%CVE-2020-15114HIGHDenial of Service in etcdEPSS 1.1%CVE-2023-32082LOWetcd key name can be accessed via LeaseTimeToLive APIEPSS 0.7%CVE-2026-73499HIGHetcd: Watch API authorization bypass via open-ended range requestsEPSS 0.7%