« Volver al listado

CVE-2020-14044

Estado: ModificadaAlta (7.2)—

** PRODUCTO NO COMPATIBLE CUANDO SE ASIGNO ** Se detectó una vulnerabilidad de tipo Server-Side Request Forgery (SSRF) en Codiad versiones v1.7.8 y posteriores. Un usuario con privilegios de administrador podría usar la funcionalidad plugin install para hacer que el servidor solicite cualquier URL por medio del archivo components/market/class.market.php. Esto podría potencialmente resultar en una ejecución de código remota . NOTA: el proveedor declara que "Codiad ya no se encuentra bajo mantenimiento activo por parte de los contribuyentes principales".

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Codiad — Codiad

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-14044",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-08-24T16:15:10.703",
  "references": [
    {
      "url": "https://advisory.checkmarx.net/advisory/CX-2020-4280",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/Codiad/Codiad/blob/master/README.md",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/Codiad/Codiad/issues/1122",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://advisory.checkmarx.net/advisory/CX-2020-4280",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/Codiad/Codiad/blob/master/README.md",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/Codiad/Codiad/issues/1122",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Server-Side Request Forgery (SSRF) vulnerability was found in Codiad v1.7.8 and later. A user with admin privileges could use the plugin install feature to make the server request any URL via components/market/class.market.php. This could potentially result in remote code execution. NOTE: the vendor states \"Codiad is no longer under active maintenance by core contributors.\""
    },
    {
      "lang": "es",
      "value": "** PRODUCTO NO COMPATIBLE CUANDO SE ASIGNO ** Se detectó una vulnerabilidad de tipo Server-Side Request Forgery (SSRF) en Codiad versiones v1.7.8 y posteriores. Un usuario con privilegios de administrador podría usar la funcionalidad plugin install para hacer que el servidor solicite cualquier URL por medio del archivo components/market/class.market.php. Esto podría potencialmente resultar en una ejecución de código remota . NOTA: el proveedor declara que \"Codiad ya no se encuentra bajo mantenimiento activo por parte de los contribuyentes principales\"."
    }
  ],
  "lastModified": "2026-06-17T02:54:09.067",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:codiad:codiad:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43C9171C-2531-46A0-9952-70E476FB6A46",
              "versionStartIncluding": "1.7.8"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}