Aptare
CVE-2020-27156
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
Veritas APTARE versions prior to 10.5 did not perform adequate authorization checks. This vulnerability could allow for remote code execution by an unauthenticated user.
AnalysisAI
Veritas APTARE versions prior to 10.5 did not perform adequate authorization checks. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Incorrect Authorization (CWE-863), which allows attackers to bypass authorization checks to access restricted resources. Veritas APTARE versions prior to 10.5 did not perform adequate authorization checks. This vulnerability could allow for remote code execution by an unauthenticated user. Affected products include: Veritas Aptare. Version information: prior to 10.5.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Review and test authorization logic, implement consistent access control checks, use centralized authorization framework.
Veritas APTARE versions prior to 10.4 included code that bypassed the normal login process when specific authentication
Veritas APTARE versions prior to 10.5 included code that bypassed the normal login process when specific authentication
Veritas APTARE versions prior to 10.4 allowed sensitive information to be accessible without authentication. Rated high
Veritas APTARE versions prior to 10.4 allowed remote users to access several unintended files on the server. Rated high
Veritas APTARE versions prior to 10.4 did not perform adequate authorization checks. Rated medium severity (CVSS 6.3), t
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today