CVEvulnerability
CVE-2020-35205
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2021-01-11
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-918
Description
Server Side Request Forgery (SSRF) in Web Compliance Manager in Quest Policy Authority version 8.1.2.200 allows attackers to scan internal ports and make outbound connections via the initFile.jsp file. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Affected configurations
• quest policy authority for unified communications 8.1.2.200
Related
Weakness · CWE (1)
- CWE-918 Server-Side Request Forgery weakness
References
- https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications Exploit, Third Party Advisory
- https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications Exploit, Third Party Advisory
- https://clandestinelabs.io/security-advisories/advisory-multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications Exploit, Third Party Advisory
- https://un4gi.io/blog/multiple-vulnerabilities-in-quest-policy-authority-for-unified-communications Exploit, Third Party Advisory