‹ Volver al listado

CVE-2020-13963

Estado: ModificadaCrítica (9.8)—
Gravedad9.8Crítica · CVSS 3.1
Probabilidad de explotación1.81 %mayor que el 78 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoNo conocidosin código público localizado

SOPlanning versiones anteriores a 1.47, presenta un Control de Acceso Incorrecto porque determinada información de clave secreta y el algoritmo de autenticación relacionado es público. La clave de administrador está embebida en el código de instalación y no existe clave para publicsp (que es una cuenta de invitado)

CVSS

Puntuación base
9.8
Versión
3.1
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días
1.81 %
Percentil entre todas las CVEs puntuadas
78
Fecha de la puntuación
23/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Soplanning — Soplanning

CWE

Referencias

Mostrar las 6 referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-13963",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-03-21T21:15:12.530",
  "references": [
    {
      "url": "https://cwe.mitre.org/data/definitions/321.html",
      "tags": [
        "Technical Description"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://forum.soplanning.org/viewforum.php?f=8",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://labs.integrity.pt/advisories/cve-2020-13963/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://cwe.mitre.org/data/definitions/321.html",
      "tags": [
        "Technical Description"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://forum.soplanning.org/viewforum.php?f=8",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://labs.integrity.pt/advisories/cve-2020-13963/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-798"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SOPlanning before 1.47 has Incorrect Access Control because certain secret key information, and the related authentication algorithm, is public. The key for admin is hardcoded in the installation code, and there is no key for publicsp (which is a guest account)."
    },
    {
      "lang": "es",
      "value": "SOPlanning versiones anteriores a 1.47, presenta un Control de Acceso Incorrecto porque determinada información de clave secreta y el algoritmo de autenticación relacionado es público. La clave de administrador está embebida en el código de instalación y no existe clave para publicsp (que es una cuenta de invitado)"
    }
  ],
  "lastModified": "2026-06-17T02:54:01.250",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:soplanning:soplanning:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0C314621-724F-435A-8B74-3C7CD3A4CAB6",
              "versionEndExcluding": "1.47",
              "versionStartIncluding": "1.45"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}