CVE-2020-14341

{"id": "CVE-2020-14341", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.2}]}, "published": "2021-01-12T15:15:13.593", "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1860138", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-385"}]}], "descriptions": [{"lang": "en", "value": "The \"Test Connection\" available in v7.x of the Red Hat Single Sign On application console can permit an authorized user to cause SMTP connections to be attempted to arbitrary hosts and ports of the user's choosing, and originating from the RHSSO installation. By observing differences in the timings of these scans, an attacker may glean information about hosts and ports which they do not have access to scan directly."}, {"lang": "es", "value": "La \"Test Connection\" disponible en la versi\u00f3n v7.x de la consola de la aplicaci\u00f3n Red Hat Single Sign On puede permitir a un usuario autorizado causar conexiones SMTP que se intentar\u00e1n con hosts y puertos arbitrarios para hosts y puertos arbitrarios que elija el usuario, y que se originen la instalaci\u00f3n de RHSSO. Al observar las diferencias en los tiempos de estos an\u00e1lisis, un atacante puede obtener informaci\u00f3n sobre hosts y puertos a los que no tiene acceso para analizar directamente"}], "lastModified": "2021-01-19T14:03:14.980", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:single_sign-on:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6999270F-5739-486B-A2C2-1DA8E746D8DB", "versionEndIncluding": "7.4", "versionStartIncluding": "7.0"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}