Vulnerabilities > CVE-2020-13413 - Information Exposure Through Discrepancy vulnerability in Aviatrix Controller

CVSS 5.3 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

LOW

Integrity impact

NONE

Availability impact

NONE

network

low complexity

aviatrix

CWE-203

NVD

Published: 2020-05-22

Updated: 2021-12-01

Summary

An issue was discovered in Aviatrix Controller before 5.4.1204. There is a Observable Response Discrepancy from the API, which makes it easier to perform user enumeration via brute force.

Vulnerable Configurations

Part	Description	Count
Application	Aviatrix Aviatrix Controller 2.5 Aviatrix Controller 2.6 Aviatrix Controller 2.7 Aviatrix Controller 3.0 Aviatrix Controller 3.1 Aviatrix Controller 3.2 Aviatrix Controller 3.3 Aviatrix Controller 3.4 Aviatrix Controller 3.5 Aviatrix Controller 4.0 Aviatrix Controller 4.1.914 Aviatrix Controller 4.1.946 Aviatrix Controller 4.2.634 Aviatrix Controller 4.2.740 Aviatrix Controller 4.2.764 Aviatrix Controller 4.3.1230 Aviatrix Controller 4.3.1262 Aviatrix Controller 4.3.1275 Aviatrix Controller 4.6.587 Aviatrix Controller 4.7.378 Aviatrix Controller 4.7.419 Aviatrix Controller 4.7.473 Aviatrix Controller 4.7.494 Aviatrix Controller 4.7.501 Aviatrix Controller 4.7.581 Aviatrix Controller 4.7.590 Aviatrix Controller 5.0.2667 Aviatrix Controller 5.0.2754 Aviatrix Controller 5.0.2768 Aviatrix Controller 5.0.2773 Aviatrix Controller 5.0.2782 Aviatrix Controller 5.1.842 Aviatrix Controller 5.1.845 Aviatrix Controller 5.1.935 Aviatrix Controller 5.1.943 Aviatrix Controller 5.1.962 Aviatrix Controller 5.1.969 Aviatrix Controller 5.1.973 Aviatrix Controller 5.1.989 Aviatrix Controller 5.1.1016 Aviatrix Controller 5.1.1183 Aviatrix Controller 5.2.1991 Aviatrix Controller 5.2.2011 Aviatrix Controller 5.2.2047 Aviatrix Controller 5.2.2071 Aviatrix Controller 5.2.2092 Aviatrix Controller 5.2.2122 Aviatrix Controller 5.3 Aviatrix Controller 5.3.1391 Aviatrix Controller 5.3.1399 Aviatrix Controller 5.3.1428 Aviatrix Controller 5.3.1468 Aviatrix Controller 5.3.1491 Aviatrix Controller 5.3.1499 Aviatrix Controller 5.3.1516 Aviatrix Controller 5.3.1524 Aviatrix Controller 5.4.1066 Aviatrix Controller 5.4.1074 Aviatrix Controller 5.4.1140 Aviatrix Controller 5.4.1201 Aviatrix VPN Client 2.8.2	61

Common Weakness Enumeration (CWE)

CWE-203 - Information Exposure Through Discrepancy

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References