CVE-2020-35391

MEDIUM Year: 2020
CVSS v3 Score
6.5
Medium
CVSS v2 Score
3.3
Low
Weakness Type
CWE-425
View all →

Vulnerability Description

Tenda N300 F3 12.01.01.48 devices allow remote attackers to obtain sensitive information (possibly including an http_passwd line) via a direct request for cgi-bin/DownloadCfg/RouterCfm.cfg, a related issue to CVE-2017-14942. NOTE: the vulnerability report may suggest that either a ? character must be placed after the RouterCfm.cfg filename, or that the HTTP request headers must be unusual, but it is not known why these are relevant to the device's HTTP response behavior.

Related Vulnerabilities

CVE-2015-1313

MEDIUM
CVSS:6.5(Medium)

JetBrains TeamCity 8 and 9 before 9.0.2 allows bypass of account-creation restrictions via a crafted request because the required request data can be deduced by reading HTML and JavaScript files that ...

CWE-4252015

CVE-2017-2486

MEDIUM
CVSS:6.5(Medium)

An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to spoof the addre...

CWE-4252017

CVE-2018-19143

MEDIUM
CVSS:6.5(Medium)

Open Ticket Request System (OTRS) 4.0.x before 4.0.33, 5.0.x before 5.0.31, and 6.0.x before 6.0.13 allows an authenticated user to delete files via a modified submission form because upload caching i...

CWE-4252018

CVE-2020-13474

MEDIUM
CVSS:6.5(Medium)

In NCH Express Accounts 8.24 and earlier, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functionalities such as Add/Edit users.

CWE-4252020

CVE-2020-8439

MEDIUM
CVSS:6.5(Medium)

Monstra CMS through 3.0.4 allows remote authenticated users to take over arbitrary user accounts via a modified login parameter to an edit URI, as demonstrated by login=victim to the users/21/edit URI...

CWE-4252020

CVE-2021-40616

MEDIUM
CVSS:6.5(Medium)

thinkcmf v5.1.7 has an unauthorized vulnerability. The attacker can modify the password of the administrator account with id 1 through the background user management group permissions. The use conditi...

CWE-4252021