What is CVE-2020-12855?

CVE-2020-12855 is a high-severity vulnerability in Seczetta Neprofile, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 8.8/10. Published 2020-08-26.

How severe is CVE-2020-12855?

High severity. CVSS v3 base score is 8.8 out of 10.

Vulnerability in Seczetta Neprofile

CVE-2020-12855

A Host header injection vulnerability has been discovered in SecZetta NEProfile 3.3.11. Authenticated remote adversaries can poison this header resulting in an adversary controlling the execution flow for the 302 HTTP status.

EPSS: 0.022 (80.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Seczetta Neprofile — versions 3.3.11
N/a — versions n/a

Weakness classification (CWE)

CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)

References

cve@mitre.org (VDB Entry, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2020-12855?: CVE-2020-12855 is a high-severity vulnerability in Seczetta Neprofile, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 8.8/10. Published 2020-08-26.
How severe is CVE-2020-12855?: High severity. CVSS v3 base score is 8.8 out of 10.