CVE-2020-15087

In Presto before version 337, authenticated users can bypass authorization checks by directly accessing internal APIs. This impacts Presto server installations with secure internal communication configured. This does not affect installations that have not configured secure internal communication, as these installations are inherently insecure. This only affects Presto server installations. This does NOT affect clients such as the CLI or JDBC driver. This vulnerability has been fixed in version 337. Additionally, this issue can be mitigated by blocking network access to internal APIs on the coordinator and workers.

• CWE-285

• https://github.com/prestosql/presto/security/advisories/GHSA-f6pc-crhh-cp96Third Party Advisory
• https://trino.io/docs/current/release/release-337.html#security-changesRelease Notes, Vendor Advisory
• https://github.com/prestosql/presto/security/advisories/GHSA-f6pc-crhh-cp96Third Party Advisory
• https://trino.io/docs/current/release/release-337.html#security-changesRelease Notes, Vendor Advisory

Published

Jun 30, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15081In PrestaShop from version 1.5.0.0 and before 1.7.6.6, there…5.3
• CVE-2020-15082In PrestaShop from version 1.6.0.1 and before version 1.7.6.…8.8
• CVE-2020-15083In PrestaShop from version 1.7.0.0 and before version 1.7.6.…6.1
• CVE-2020-15084In express-jwt (NPM package) up and including version 5.3.3,…9.1
• CVE-2020-15085In Saleor Storefront before version 2.10.3, request data use…6.1
• CVE-2020-15086In TYPO3 installations with the "mediace" extension from ver…9.8
• CVE-2020-1509An elevation of privilege vulnerability exists in the Local …7.8
• CVE-2020-15091TenderMint from version 0.33.0 and before version 0.33.6 all…6.5
• CVE-2020-15092In TimelineJS before version 3.7.0, some user data renders a…4.8
• CVE-2020-15093The tough library (Rust/crates.io) prior to version 0.7.1 do…8.6
• CVE-2020-15094In Symfony before versions 4.4.13 and 5.1.5, the CachingHttp…8.8
• CVE-2020-15095Versions of the npm CLI prior to 6.14.6 are vulnerable to an…4.4