High severity · published Sep 9, 2020
CVE-2020-15789
A vulnerability has been identified in Polarion Subversion Webclient (All versions)
8.1
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability has been identified in Polarion Subversion Webclient (All versions). The web interface could allow a Cross-Site Request Forgery (CSRF) attack if an unsuspecting user is tricked into accessing a malicious link. Successful exploitation requires user interaction by a legitimate user, who must be authenticated to the web interface. A successful attack could allow an attacker to trigger actions via the web interface that the legitimate user is allowed to perform. This could allow the attacker to read or modify contents of the web application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 42% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PS
Polarion Subversion Webclient · Siemens
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-15789
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-15789
Vendor Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-436520.pdf
More from Polarion Subversion Webclient
6.1
CVE-2021-44478
A vulnerability has been identified in Polarion ALM (All versions < V21 R2 P2), Polarion WebClient for SVN (All versions)
6.1
CVE-2020-15788
A vulnerability has been identified in Polarion Subversion Webclient (All versions)
