CVE-2020-11000
GreenBrowser before version 1.2 has a vulnerability where apps that rely on URL Parsing to verify that a given URL is pointing to a trust server may be susceptible to many different ways to get URL parsing and verification wrong, which allows an…
Does this matter?
Lower severity and a low EPSS score (1.24%). Track it; it rarely justifies an emergency change on its own.
Description
GreenBrowser before version 1.2 has a vulnerability where apps that rely on URL Parsing to verify that a given URL is pointing to a trust server may be susceptible to many different ways to get URL parsing and verification wrong, which allows an attacker to circumvent the access control. This problem has been patched in version 1.2.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- EPSS
- 1.24% probability · 68th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-939
- Affected
- greenbrowser project/greenbrowser
- Source
- security-advisories@github.com
References
- https://github.com/luchua-bc/GreenBrowser/commit/5e257e0db4f2a08cf05f00756e5961ee873e481bPatch, Third Party Advisory
- https://github.com/luchua-bc/GreenBrowser/security/advisories/GHSA-7x3j-7x5w-8g7wThird Party Advisory
- https://github.com/luchua-bc/GreenBrowser/commit/5e257e0db4f2a08cf05f00756e5961ee873e481bPatch, Third Party Advisory
- https://github.com/luchua-bc/GreenBrowser/security/advisories/GHSA-7x3j-7x5w-8g7wThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.