CVE-2020-12855
Last modified
CVE-2020-12855 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. A Host header injection vulnerability has been discovered in SecZetta NEProfile 3.3.11. Authenticated remote adversaries can poison this header resulting in an adversary controlling the execution flow for the 302 HTTP status.. EPSS estimates a 2.23% chance of exploitation in the next 30 days.
Description
A Host header injection vulnerability has been discovered in SecZetta NEProfile 3.3.11. Authenticated remote adversaries can poison this header resulting in an adversary controlling the execution flow for the 302 HTTP status.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Seczetta | Neprofile | 3.3.11 |
References
- http://packetstormsecurity.com/files/158965/SecZetta-NEProfile-3.3.11-Host-Header-Injection.htmlThird Party Advisory, VDB Entry
- http://packetstormsecurity.com/files/158965/SecZetta-NEProfile-3.3.11-Host-Header-Injection.htmlThird Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-12855?
How severe is CVE-2020-12855?
How do I fix CVE-2020-12855?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-1285<p>A remote code execution vulnerability exists in the way t…8.4
- CVE-2020-12850The following vulnerability applies only to the Pydio Cells …7
- CVE-2020-12851Pydio Cells 2.0.4 allows an authenticated user to write or o…8.1
- CVE-2020-12852The update feature for Pydio Cells 2.0.4 allows an administr…6.8
- CVE-2020-12853Pydio Cells 2.0.4 allows XSS. A malicious user can either up…6.1
- CVE-2020-12854A remote code execution vulnerability was identified in SecZ…8.8
- CVE-2020-12856OpenTrace, as used in COVIDSafe through v1.0.17, TraceTogeth…9.8
- CVE-2020-12857Caching of GATT characteristic values (TempID) in COVIDSafe …7.5
- CVE-2020-12858Non-reinitialisation of random data in the advertising paylo…7.5
- CVE-2020-12859Unnecessary fields in the OpenTrace/BlueTrace protocol in CO…5.3
- CVE-2020-1286A remote code execution vulnerability exists when the Window…8.8
- CVE-2020-12860COVIDSafe through v1.0.17 allows a remote attacker to access…5.3
Are you affected by CVE-2020-12855?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST