CVE-2020-15135

{"containers": {"cna": {"affected": [{"product": "save-server", "vendor": "Neztore", "versions": [{"status": "affected", "version": "< 1.0.5"}]}], "descriptions": [{"lang": "en", "value": "save-server (npm package) before version 1.05 is affected by a CSRF vulnerability, as there is no CSRF mitigation (Tokens etc.). The fix introduced in version version 1.05 unintentionally breaks uploading so version v1.0.7 is the fixed version. This is patched by implementing Double submit. The CSRF attack would require you to navigate to a malicious site while you have an active session with Save-Server (Session key stored in cookies). The malicious user would then be able to perform some actions, including uploading/deleting files and adding redirects. If you are logged in as root, this attack is significantly more severe. They can in addition create, delete and update users. If they updated the password of a user, that user's files would then be available. If the root password is updated, all files would be visible if they logged in with the new password. Note that due to the same origin policy malicious actors cannot view the gallery or the response of any of the methods, nor be sure they succeeded. This issue has been patched in version 1.0.7."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "description": "{\"CWE-352\":\"Cross-Site Request Forgery (CSRF)\"}", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-08-04T20:25:14.000Z", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/Neztore/save-server/security/advisories/GHSA-wwrj-35w6-77ff"}, {"tags": ["x_refsource_MISC"], "url": "https://medium.com/cross-site-request-forgery-csrf/double-submit-cookie-pattern-65bb71d80d9f"}, {"tags": ["x_refsource_MISC"], "url": "https://www.npmjs.com/package/save-server"}], "source": {"advisory": "GHSA-wwrj-35w6-77ff", "discovery": "UNKNOWN"}, "title": "CSRF vulnerability in save-server", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2020-15135", "STATE": "PUBLIC", "TITLE": "CSRF vulnerability in save-server"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "save-server", "version": {"version_data": [{"version_value": "< 1.0.5"}]}}]}, "vendor_name": "Neztore"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "save-server (npm package) before version 1.05 is affected by a CSRF vulnerability, as there is no CSRF mitigation (Tokens etc.). The fix introduced in version version 1.05 unintentionally breaks uploading so version v1.0.7 is the fixed version. This is patched by implementing Double submit. The CSRF attack would require you to navigate to a malicious site while you have an active session with Save-Server (Session key stored in cookies). The malicious user would then be able to perform some actions, including uploading/deleting files and adding redirects. If you are logged in as root, this attack is significantly more severe. They can in addition create, delete and update users. If they updated the password of a user, that user's files would then be available. If the root password is updated, all files would be visible if they logged in with the new password. Note that due to the same origin policy malicious actors cannot view the gallery or the response of any of the methods, nor be sure they succeeded. This issue has been patched in version 1.0.7."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "{\"CWE-352\":\"Cross-Site Request Forgery (CSRF)\"}"}]}]}, "references": {"reference_data": [{"name": "https://github.com/Neztore/save-server/security/advisories/GHSA-wwrj-35w6-77ff", "refsource": "CONFIRM", "url": "https://github.com/Neztore/save-server/security/advisories/GHSA-wwrj-35w6-77ff"}, {"name": "https://medium.com/cross-site-request-forgery-csrf/double-submit-cookie-pattern-65bb71d80d9f", "refsource": "MISC", "url": "https://medium.com/cross-site-request-forgery-csrf/double-submit-cookie-pattern-65bb71d80d9f"}, {"name": "https://www.npmjs.com/package/save-server", "refsource": "MISC", "url": "https://www.npmjs.com/package/save-server"}]}, "source": {"advisory": "GHSA-wwrj-35w6-77ff", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T13:08:22.257Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/Neztore/save-server/security/advisories/GHSA-wwrj-35w6-77ff"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://medium.com/cross-site-request-forgery-csrf/double-submit-cookie-pattern-65bb71d80d9f"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.npmjs.com/package/save-server"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2020-15135", "datePublished": "2020-08-04T20:25:14.000Z", "dateReserved": "2020-06-25T00:00:00.000Z", "dateUpdated": "2024-08-04T13:08:22.257Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "save-server", "vendor": "Neztore", "versions": [{"status": "affected", "version": "< 1.0.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:save-server_project:save-server:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "137FD172-368B-4855-AB15-7C7B24ECBF96", "versionEndExcluding": "1.0.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "save-server (npm package) before version 1.05 is affected by a CSRF vulnerability, as there is no CSRF mitigation (Tokens etc.). The fix introduced in version version 1.05 unintentionally breaks uploading so version v1.0.7 is the fixed version. This is patched by implementing Double submit. The CSRF attack would require you to navigate to a malicious site while you have an active session with Save-Server (Session key stored in cookies). The malicious user would then be able to perform some actions, including uploading/deleting files and adding redirects. If you are logged in as root, this attack is significantly more severe. They can in addition create, delete and update users. If they updated the password of a user, that user's files would then be available. If the root password is updated, all files would be visible if they logged in with the new password. Note that due to the same origin policy malicious actors cannot view the gallery or the response of any of the methods, nor be sure they succeeded. This issue has been patched in version 1.0.7."}, {"lang": "es", "value": "save-server (paquete npm) anterior a la versi\u00f3n 1.05, est\u00e1 afectada por una vulnerabilidad de tipo CSRF, ya que no hay mitigaci\u00f3n de CSRF (tokens, etc.). La correcci\u00f3n introducida en la versi\u00f3n 1.05 bloquea involuntariamente la carga, por lo que la versi\u00f3n v1.0.7 es la versi\u00f3n corregida. Esto es parcheado mediante la implementaci\u00f3n de env\u00edo Doble. El ataque de tipo CSRF requerir\u00eda que navegues en un sitio malicioso mientras tienes una sesi\u00f3n activa con Save-Server (clave de sesi\u00f3n almacenada en las cookies). El usuario malicioso podr\u00eda realizar algunas acciones, incluyendo la carga y eliminaci\u00f3n de archivos y la adici\u00f3n de redireccionamientos. Si ha iniciado sesi\u00f3n como root, este ataque es significativamente m\u00e1s severo. Adicionalmente, pueden crear, eliminar y actualizar usuarios. Si actualizaran la contrase\u00f1a de un usuario, los archivos de ese usuario estar\u00edan disponibles. Si se actualiza la contrase\u00f1a de root, todos los archivos ser\u00edan visibles si iniciaran sesi\u00f3n con la nueva contrase\u00f1a. Tome cuenta que debido a la pol\u00edtica del mismo origen, los actores maliciosos no pueden ver la galer\u00eda ni la respuesta de ninguno de los m\u00e9todos, ni asegurarse de que hayan tenido \u00e9xito. Este problema ha sido parcheado en la versi\u00f3n 1.0.7"}], "id": "CVE-2020-15135", "lastModified": "2026-06-17T02:56:07.223", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.5, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 5.5, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-08-04T21:15:14.953", "references": [{"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/Neztore/save-server/security/advisories/GHSA-wwrj-35w6-77ff"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://medium.com/cross-site-request-forgery-csrf/double-submit-cookie-pattern-65bb71d80d9f"}, {"source": "security-advisories@github.com", "tags": ["Product", "Third Party Advisory"], "url": "https://www.npmjs.com/package/save-server"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/Neztore/save-server/security/advisories/GHSA-wwrj-35w6-77ff"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://medium.com/cross-site-request-forgery-csrf/double-submit-cookie-pattern-65bb71d80d9f"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product", "Third Party Advisory"], "url": "https://www.npmjs.com/package/save-server"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-352"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-352"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{}