Vulnerability in Red Hat Single Sign-On
CVE-2020-14341
The "Test Connection" available in v7.x of the Red Hat Single Sign On application console can permit an authorized user to cause SMTP connections to be attempted to arbitrary hosts and ports of the user's choosing, and originating from the RHSSO installation. By observing differences in the timings of these scans, an attacker may glean information about hosts and ports which they do not have access to scan directly.
EPSS: 0.009 (57.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 2.7 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Red Hat Single Sign-on — versions v7.x
- Redhat Single_sign-on
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_CONFIRM, Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-14341?
- CVE-2020-14341 is a low-severity vulnerability in Red Hat Single Sign-On, classified under CWE-385. CVSS score: 2.7/10. Published 2021-01-12.
- How severe is CVE-2020-14341?
- Low severity. CVSS v3 base score is 2.7 out of 10.