CVE-2020-29022
Host Header Injection allowing web cache poisoning attacks
Severity Score
5.3
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
Failure to Sanitize host header value on output in the GateManager Web server could allow an attacker to conduct web cache poisoning attacks. This issue affects Secomea GateManager all versions prior to 9.3
Un fallo en la saneamiento del valor del encabezado del host en la salida del servidor web GateManager, podría permitir a un atacante conducir ataques de envenenamiento de la caché web. Este problema afecta a Secomea GateManager todas las versiones anteriores a 9.3
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2020-11-24 CVE Reserved
- 2021-02-16 CVE Published
- 2023-11-02 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-159: Improper Handling of Invalid Use of Special Elements
CAPEC
References (1)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.secomea.com/support/cybersecurity-advisory/#2923 | 2021-02-26 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Secomea Search vendor "Secomea" | Gatemanager 4250 Firmware Search vendor "Secomea" for product "Gatemanager 4250 Firmware" | * | - |
Affected
| in | Secomea Search vendor "Secomea" | Gatemanager 4250 Search vendor "Secomea" for product "Gatemanager 4250" | - | - |
Safe
|
| Secomea Search vendor "Secomea" | Gatemanager 4260 Firmware Search vendor "Secomea" for product "Gatemanager 4260 Firmware" | * | - |
Affected
| in | Secomea Search vendor "Secomea" | Gatemanager 4260 Search vendor "Secomea" for product "Gatemanager 4260" | - | - |
Safe
|
| Secomea Search vendor "Secomea" | Gatemanager 9250 Firmware Search vendor "Secomea" for product "Gatemanager 9250 Firmware" | * | - |
Affected
| in | Secomea Search vendor "Secomea" | Gatemanager 9250 Search vendor "Secomea" for product "Gatemanager 9250" | - | - |
Safe
|
| Secomea Search vendor "Secomea" | Gatemanager 8250 Firmware Search vendor "Secomea" for product "Gatemanager 8250 Firmware" | < 9.3 Search vendor "Secomea" for product "Gatemanager 8250 Firmware" and version " < 9.3" | - |
Affected
| in | Secomea Search vendor "Secomea" | Gatemanager 8250 Search vendor "Secomea" for product "Gatemanager 8250" | - | - |
Safe
|