Miggo Logo
Book a Demo
Miggo Vulnerability Database
→
CVE-2020-36660

CVE-2020-36660:
Exposure of Sensitive Information in EVE-SRP

4.3

CVSS Score

Basic Information

CVE ID
CVE-2020-36660
GHSA ID
GHSA-fxqx-xgqq-gf42
EPSS Score
-
CWE
CWE-200
Published
2/6/2023
Updated
9/20/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
EVE-SRPpip< 0.12.120.12.12

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The commit diff shows both functions lacked security decorators and permission checks prior to patching. The vulnerability report specifically mentions unauthorized access via /api/user/<id> and /api/group/<id> routes. The added @login_required decorator and admin permission checks in the patch directly address these authorization flaws, confirming these were the vulnerable endpoints.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* vuln*r**ility w*s *oun* in p*xswill *V* S*ip R*pl***m*nt Pro*r*m *.**.**. It **s ***n r*t** *s pro*l*m*ti*. T*is issu* *****ts som* unknown pro**ssin* o* t** *il* sr*/*v*srp/vi*ws/*pi.py o* t** *ompon*nt Us*r In*orm*tion **n*l*r. T** m*nipul*tion l

Reasoning

T** *ommit *i** s*ows *ot* *un*tions l**k** s**urity ***or*tors *n* p*rmission ****ks prior to p*t**in*. T** vuln*r**ility r*port sp**i*i**lly m*ntions un*ut*oriz** ****ss vi* /*pi/us*r/<i*> *n* /*pi/*roup/<i*> rout*s. T** ***** @lo*in_r*quir** ***or