Aviatrix Controller 2.7

CPE Details

Aviatrix Controller 2.7
aviatrix
controller
2.7
2020-05-29
13h02 +00:00
2020-05-29
13h02 +00:00
CPE NVD
Alerte pour un CPE
Restez informé de toutes modifications pour un CPE spécifique.
Gestion des notifications

CPE Name: cpe:2.3:a:aviatrix:controller:2.7:*:*:*:*:*:*:*

Informations

Vendor

aviatrix

Product

controller

Version

2.7

Related CVE

Open and find in CVE List

CVE ID Publié Description Score Gravité
CVE-2024-50603 2025-01-08 00h00 +00:00 An issue was discovered in Aviatrix Controller before 7.1.4191 and 7.2.x before 7.2.4996. Due to the improper neutralization of special elements used in an OS command, an unauthenticated attacker is able to execute arbitrary code. Shell metacharacters can be sent to /v1/api in cloud_type for list_flightpath_destination_instances, or src_cloud_type for flightpath_connection_test.
10
Critique
CVE-2020-13412 2020-05-22 18h48 +00:00 An issue was discovered in Aviatrix Controller before 5.4.1204. An API call on the web interface lacked a session token check to control access, leading to CSRF.
8.8
Haute
CVE-2020-13413 2020-05-22 18h48 +00:00 An issue was discovered in Aviatrix Controller before 5.4.1204. There is a Observable Response Discrepancy from the API, which makes it easier to perform user enumeration via brute force.
5.3
Moyen
CVE-2020-13414 2020-05-22 18h48 +00:00 An issue was discovered in Aviatrix Controller before 5.4.1204. It contains credentials unused by the software.
7.5
Haute
CVE-2020-13415 2020-05-22 18h48 +00:00 An issue was discovered in Aviatrix Controller through 5.1. An attacker with any signed SAML assertion from the Identity Provider can establish a connection (even if that SAML assertion has expired or is from a user who is not authorized to access Aviatrix), aka XML Signature Wrapping.
7.5
Haute
CVE-2020-13416 2020-05-22 18h48 +00:00 An issue was discovered in Aviatrix Controller before 5.4.1066. A Controller Web Interface session token parameter is not required on an API call, which opens the application up to a Cross Site Request Forgery (CSRF) vulnerability for password resets.
6.5
Moyen
CVE-2020-13417 2020-05-22 18h47 +00:00 An Elevation of Privilege issue was discovered in Aviatrix VPN Client before 2.10.7, because of an incomplete fix for CVE-2020-7224. This affects Linux, macOS, and Windows installations for certain OpenSSL parameters.
9.8
Critique