Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-15703

CVE-2020-15703: aptdaemon Information Disclosure via Improper Input Validation in Transaction class

4

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-15703
GHSA ID
GHSA-wpmr-q825-x4c6
EPSS Score
0.13111%
CWE
CWE-200
Published
5/24/2022
Updated
8/16/2023
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
aptdaemonpip< 1.1.11.1.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from missing path validation in the locale handling of Transaction class. The patch adds a check for '/' in locale_str, confirming the flaw existed in _set_locale method. The CVE-2020-15703.patch directly modifies this function in core.py, and the vulnerability description matches this code context.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T**r* is no input v*li**tion on t** Lo**l* prop*rty in *n *pt tr*ns**tion. *n unprivil**** us*r **n supply * *ull p*t* to * writ**l* *ir**tory, w*i** l*ts *pt* r*** * *il* *s root. **vin* * symlink in pl*** r*sults in *n *rror m*ss*** i* t** *il* *xi

Reasoning

T** vuln*r**ility st*ms *rom missin* p*t* v*li**tion in t** lo**l* **n*lin* o* Tr*ns**tion *l*ss. T** p*t** ***s * ****k *or '/' in lo**l*_str, *on*irmin* t** *l*w *xist** in _s*t_lo**l* m*t*o*. T** *V*-****-*****.p*t** *ir**tly mo*i*i*s t*is *un*tio