Vulnerability-Lookup

CVE-2020-15168 (GCVE-0-2020-15168)

Vulnerability from cvelistv5 – Published: 2020-09-10 18:25 – Updated: 2024-08-04 13:08

Title

File size limit bypass in node-fetch

Summary

node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.

Severity

2.6 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L

CWE

CWE-20 - Improper Input Validation
CWE-770 - Allocation of Resources Without Limits or Throttling

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/node-fetch/node-fetch/security…	x_refsource_CONFIRM
https://www.npmjs.com/package/node-fetch	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
node-fetch	node-fetch	Affected: <2.6.1 Affected: >3.0.0-beta.1, <3.0.0-beta.9	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:08:22.463Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/node-fetch/node-fetch/security/advisories/GHSA-w7rc-rwvf-8q5r"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.npmjs.com/package/node-fetch"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "node-fetch",
          "vendor": "node-fetch",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c2.6.1"
            },
            {
              "status": "affected",
              "version": "\u003e3.0.0-beta.1, \u003c3.0.0-beta.9"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don\u0027t double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 2.6,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-770",
              "description": "CWE-770 Allocation of Resources Without Limits or Throttling",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-09-10T18:25:13.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/node-fetch/node-fetch/security/advisories/GHSA-w7rc-rwvf-8q5r"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.npmjs.com/package/node-fetch"
        }
      ],
      "source": {
        "advisory": "GHSA-w7rc-rwvf-8q5r",
        "discovery": "UNKNOWN"
      },
      "title": "File size limit bypass in node-fetch",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-15168",
          "STATE": "PUBLIC",
          "TITLE": "File size limit bypass in node-fetch"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "node-fetch",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c2.6.1"
                          },
                          {
                            "version_value": "\u003e3.0.0-beta.1, \u003c3.0.0-beta.9"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "node-fetch"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don\u0027t double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 2.6,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-20: Improper Input Validation"
                }
              ]
            },
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-770 Allocation of Resources Without Limits or Throttling"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/node-fetch/node-fetch/security/advisories/GHSA-w7rc-rwvf-8q5r",
              "refsource": "CONFIRM",
              "url": "https://github.com/node-fetch/node-fetch/security/advisories/GHSA-w7rc-rwvf-8q5r"
            },
            {
              "name": "https://www.npmjs.com/package/node-fetch",
              "refsource": "MISC",
              "url": "https://www.npmjs.com/package/node-fetch"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-w7rc-rwvf-8q5r",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-15168",
    "datePublished": "2020-09-10T18:25:13.000Z",
    "dateReserved": "2020-06-25T00:00:00.000Z",
    "dateUpdated": "2024-08-04T13:08:22.463Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2020-15168",
      "date": "2026-09-19",
      "epss": "0.01692",
      "percentile": "0.76075"
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:node-fetch_project:node-fetch:*:*:*:*:*:node.js:*:*",
                    "matchCriteriaId": "DFF1F6BD-BADD-4347-8E55-F9BC6F0208DC",
                    "versionEndExcluding": "2.6.1",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:node-fetch_project:node-fetch:3.0.0:beta1:*:*:*:node.js:*:*",
                    "matchCriteriaId": "B3E6018B-5323-462E-BF24-371C8C0FD83A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:node-fetch_project:node-fetch:3.0.0:beta5:*:*:*:node.js:*:*",
                    "matchCriteriaId": "C0B46F27-637F-4C06-9637-44BEDC4610B7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:node-fetch_project:node-fetch:3.0.0:beta6:*:*:*:node.js:*:*",
                    "matchCriteriaId": "3B08B9F1-6A45-4769-BC15-45FE6C40F1AD",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:node-fetch_project:node-fetch:3.0.0:beta7:*:*:*:node.js:*:*",
                    "matchCriteriaId": "96F4B288-91CC-42F6-B35F-F118DD73D4CB",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:node-fetch_project:node-fetch:3.0.0:beta8:*:*:*:node.js:*:*",
                    "matchCriteriaId": "12FF1237-1096-4FEF-AAEB-EF8D78456ED9",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don\u0027t double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing."
          },
          {
            "lang": "es",
            "value": "node-fetch  versiones anteriores a 2.6.1 y a 3.0.0-beta.9 no respetaba la opci\u00f3n de tama\u00f1o despu\u00e9s de seguir un redireccionamiento, lo que significa que cuando un tama\u00f1o de contenido superaba el l\u00edmite, una FetchError nunca se iniciaba y el proceso terminaba sin fallos.\u0026#xa0;Para la mayor\u00eda de las personas, esta soluci\u00f3n tendr\u00e1 un impacto m\u00ednimo o nulo.\u0026#xa0;Sin embargo, si conf\u00eda en node-fetch para bloquear archivos por encima de un tama\u00f1o, el impacto podr\u00eda ser significativo, por ejemplo: si no verifica dos veces el tama\u00f1o de los datos despu\u00e9s de que se haya completado la funci\u00f3n fetch(), su hilo o subproceso JS podr\u00eda atarse haciendo que en un archivo grande (DoS) y/o le cueste dinero en inform\u00e1tica"
          }
        ],
        "id": "CVE-2020-15168",
        "lastModified": "2024-11-21T05:04:59.510",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 5.0,
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 10.0,
              "impactScore": 2.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 2.6,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 1.2,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 5.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 1.4,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2020-09-10T19:15:13.490",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/node-fetch/node-fetch/security/advisories/GHSA-w7rc-rwvf-8q5r"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Product",
              "Third Party Advisory"
            ],
            "url": "https://www.npmjs.com/package/node-fetch"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://github.com/node-fetch/node-fetch/security/advisories/GHSA-w7rc-rwvf-8q5r"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Product",
              "Third Party Advisory"
            ],
            "url": "https://www.npmjs.com/package/node-fetch"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-20"
              },
              {
                "lang": "en",
                "value": "CWE-770"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-770"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-02-23T18:21:43+00:00",
      "cve": "CVE-2020-15168",
      "id": "CVE-2020-15168",
      "initial_release_date": "2020-09-10T00:00:00+00:00",
      "product_status:known_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "node-fetch: size of data after fetch() JS thread leads to DoS",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-15168.json",
      "version": "3"
    }
  }
}

RHEA-2021:0729

Vulnerability from csaf_redhat - Published: 2021-03-04 15:08 - Updated: 2026-06-26 22:49

Summary

Red Hat Enhancement Advisory: Red Hat Advanced Cluster Management for Kubernetes version 2.2 images

Severity

Moderate

Scope

8 vulnerabilities in this advisory, including CVE-2020-15168.

CVE-2020-15168

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Fixed: 78 products

https://access.redhat.com/errata/RHEA-2021:0729

Open the full advisory

SUSE-SU-2020:3235-1

Vulnerability from csaf_suse - Published: 2020-11-06 15:55 - Updated: 2020-11-06 15:55

Summary

Security update for SUSE Manager Server 4.1

Severity

Important

Scope

4 vulnerabilities in this advisory, including CVE-2020-15168.

CVE-2020-15168

5.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Recommended: 71 products

Open the full advisory

UBUNTU-CVE-2020-15168 (CVE-2020-15168)

Vulnerability from osv_ubuntu – Published: 2020-09-10 19:15 – Updated: 2025-10-24 04:48 – Source website

Details

Severity

2.6 (Low)


                    
                      CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L

5.3 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2020-15168	REPORT
	https://github.com/node-fetch/node-fetch/security…	REPORT
	https://www.npmjs.com/package/node-fetch	REPORT
	https://www.cve.org/CVERecord?id=CVE-2020-15168	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-fetch",
            "binary_version": "1.7.3-1ubuntu0.1~esm1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "node-fetch",
        "purl": "pkg:deb/ubuntu/node-fetch@1.7.3-1ubuntu0.1~esm1?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.7.3-1",
        "1.7.3-1ubuntu0.1~esm1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "node-fetch",
            "binary_version": "1.7.3-2ubuntu0.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "node-fetch",
        "purl": "pkg:deb/ubuntu/node-fetch@1.7.3-2ubuntu0.1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.7.3-1",
        "1.7.3-2",
        "1.7.3-2ubuntu0.1"
      ]
    }
  ],
  "aliases": [],
  "details": "node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don\u0027t double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.",
  "id": "UBUNTU-CVE-2020-15168",
  "modified": "2025-10-24T04:48:35Z",
  "published": "2020-09-10T19:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-15168"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/node-fetch/node-fetch/security/advisories/GHSA-w7rc-rwvf-8q5r"
    },
    {
      "type": "REPORT",
      "url": "https://www.npmjs.com/package/node-fetch"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-15168"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2020-15168"
  ]
}

WID-SEC-W-2022-1603

Vulnerability from csaf_certbund - Published: 2022-10-03 22:00 - Updated: 2026-03-24 23:00

Summary

IBM Tivoli Netcool/OMNIbus: Mehrere Schwachstellen

Severity

Hoch

Scope

24 vulnerabilities in this advisory, including CVE-2020-15168.

CVE-2020-15168

Known affected: 2 products

Open the full advisory

WID-SEC-W-2023-0856

Vulnerability from csaf_certbund - Published: 2022-05-31 22:00 - Updated: 2023-04-04 22:00

Summary

IBM QRadar SIEM: Mehrere Schwachstellen

Severity

Hoch

Scope

29 vulnerabilities in this advisory, including CVE-2020-15168.

CVE-2020-15168

In IBM QRadar SIEM existieren mehrere Schwachstellen im Zusammenhang mit bekannten Sicherheitslücken in den Komponenten Node.js und SQLite. Ein Angreifer kann diese Schwachstellen ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Open the full advisory

WID-SEC-W-2023-0857

Vulnerability from csaf_certbund - Published: 2022-05-24 22:00 - Updated: 2023-04-04 22:00

Summary

IBM QRadar SIEM: Mehrere Schwachstellen

Severity

Hoch

Scope

17 vulnerabilities in this advisory, including CVE-2020-15168.

CVE-2020-15168

In IBM QRadar SIEM existieren mehrere Schwachstellen. Die Schwachstellen bestehen in den Komponenten "Node.js", "node-sass" sowie "UAParser.js". Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstelle ausnutzen, um beliebigen Programmcode auszuführen, einen Denial of Service Zustand herbeizuführen, Dateien manipulieren oder Sicherheitsvorkehrungen zu umgehen. Zur erfolgreichen Ausnutzung einiger dieser Schwachstellen ist eine Benutzeraktion erforderlich.

Known affected: 1 product

Open the full advisory

WID-SEC-W-2023-1599

Vulnerability from csaf_certbund - Published: 2021-01-13 23:00 - Updated: 2023-06-29 22:00

Summary

IBM Security Guardium: Mehrere Schwachstellen

Severity

Hoch

Scope

18 vulnerabilities in this advisory, including CVE-2020-15168.

CVE-2020-15168

In IBM Security Guardium existieren mehrere Schwachstellen. Die Schwachstellen sind einerseits in verschiedenen Komponenten des Produktes vorhanden sowie im Produkt selbst. Ein entfernter, anonymer oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Programmcode auszuführen, Informationen offenzulegen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Angriff zu verursachen.

Known affected: 4 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2020-15168 (GCVE-0-2020-15168)

RHEA-2021:0729

SUSE-SU-2020:3235-1

UBUNTU-CVE-2020-15168 (CVE-2020-15168)

WID-SEC-W-2022-1603

WID-SEC-W-2023-0856

WID-SEC-W-2023-0857

WID-SEC-W-2023-1599

Tags

Sightings

Nomenclature

Related by attack behaviour