CVEvulnerability

CVE-2020-29031

8.1 HIGH Published 2021-02-15 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-02-15
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVSS 2.0 ([email protected])
5.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:N
Weaknesses
CWE-269, CWE-280

Description

An Insecure Direct Object Reference vulnerability exists in the web UI of the GateManager which allows an authenticated attacker to reset the password of any user in its domain or any sub-domain, via escalation of privileges. This issue affects all GateManager versions prior to 9.2c

Affected configurations

• secomea gatemanager 8250 firmware (< 9.2c) • secomea gatemanager 4250 firmware (< 9.0i) • secomea gatemanager 4260 firmware (< 9.0i) • secomea gatemanager 9250 firmware (< 9.0i)

Related

Weakness · CWE (2)

  • CWE-269 Improper Privilege Management weakness
  • CWE-280 Improper Handling of Insufficient Permissions or Privileges weakness

References