« Volver al listado

CVE-2020-26513

Estado: ModificadaMedia (5.5)—

An issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The ReqIF XML data, used by the codebeamer ALM application to import projects, is parsed by insecurely configured software components, which can be abused for XML External Entity Attacks.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Intland — Codebeamer

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-26513",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-12-07T16:15:12.153",
  "references": [
    {
      "url": "https://compass-security.com/fileadmin/Research/Advisories/2020-09_CSNC-2020-008_Intland_codeBeamer_ALM_XXE.txt",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://intland.com/codebeamer/application-lifecycle-management/",
      "tags": [
        "Product",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://compass-security.com/fileadmin/Research/Advisories/2020-09_CSNC-2020-008_Intland_codeBeamer_ALM_XXE.txt",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://intland.com/codebeamer/application-lifecycle-management/",
      "tags": [
        "Product",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-611"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The ReqIF XML data, used by the codebeamer ALM application to import projects, is parsed by insecurely configured software components, which can be abused for XML External Entity Attacks."
    },
    {
      "lang": "es",
      "value": "Se detectó un problema en Intland codeBeamer ALM versiones 10.xa 10.1.SP4. Los datos XML de ReqIF, usados por la aplicación codebeamer ALM para importar proyectos, son analizados por componentes de software configurados de manera no segura, que pueden ser objeto de abuso para Ataques de tipo XML External Entity"
    }
  ],
  "lastModified": "2026-06-17T03:08:07.497",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:intland:codebeamer:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3F3BE8BD-0868-4A50-BF06-BAE474BF5328",
              "versionEndExcluding": "10.1.0",
              "versionStartIncluding": "10.0.0"
            },
            {
              "criteria": "cpe:2.3:a:intland:codebeamer:10.1.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A0128D1A-DA5B-49EE-ABC2-DA75EF2B5594"
            },
            {
              "criteria": "cpe:2.3:a:intland:codebeamer:10.1.0:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "35461BDC-7A06-49AE-A528-DB6A986C9F14"
            },
            {
              "criteria": "cpe:2.3:a:intland:codebeamer:10.1.0:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B32DF425-549F-4BEC-A7B6-F66CE063C878"
            },
            {
              "criteria": "cpe:2.3:a:intland:codebeamer:10.1.0:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8166F01E-B271-4491-B932-00BF843D2146"
            },
            {
              "criteria": "cpe:2.3:a:intland:codebeamer:10.1.0:sp4:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "504110BC-FC0C-4A3F-824C-5BF4C573A792"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}