CVE-2020-35205

· CRITICALModified

← All CVEs

CVSS v3.1

9.8

EPSS

1.91%

Published

Jan 11, 2021

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Server Side Request Forgery (SSRF) in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to scan internal ports and make outbound connections via the initFile.jsp file. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-918

Affected Products (1)

quest · policy_authority_for_unified_communicationsvulnerable

References (4)

https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications

ExploitThird Party Advisory

https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications

ExploitThird Party Advisory

https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications

ExploitThird Party Advisory

https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications

ExploitThird Party Advisory

KEV Catalog EPSS Scores Vendors All CVEs