CVE-2020-9300 - The Access Control issues include allowing a regular user to view a restricted incident, user role escalation to admin, users adding themselves as a participant in a restricted incident, and users able to view restricted incidents via the search feature

Back Back to CVE browser

MEDIUM

The Access Control issues include allowing a regular user to view a restricted incident, user role escalation to admin, users adding themselves as a participant in a restricted incident, and users able to view restricted incidents via the search feature

Published Nov 9, 2020

6.5

MEDIUM

CVSS 3.1

EPSS 0.94%

Description

The Access Control issues include allowing a regular user to view a restricted incident, user role escalation to admin, users adding themselves as a participant in a restricted incident, and users able to view restricted incidents via the search feature. If your install has followed the secure deployment guidelines the risk of this is lowered, as this may only be exploited by an authenticated user.

Affected products

Vendor n/a Product Netflix Dispatch Default
unknown
Affected
- All versions prior to v20201106

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
n/a	Netflix Dispatch	unknown	Affected All versions prior to v20201106

Remediation

No remediation recorded yet.

Weaknesses (0)

No CWE recorded.

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-30124
Advisory
https://github.com/Netflix/dispatch/releases/tag/v20201106
x_refsource_MISCThird Party Advisory
https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-005.md
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-30124		Advisory
https://github.com/Netflix/dispatch/releases/tag/v20201106		x_refsource_MISCThird Party Advisory
https://github.com/Netflix/security-bulletins/blob/master/advisories/nflx-2020-005.md		x_refsource_MISCThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner netflix

Published Nov 9, 2020

Updated Aug 4, 2024

Reserved Feb 19, 2020

Link CVE-2020-9300

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2020-9300

Red Hat

No data

ENISA EUVD

Assigner netflix

Published Nov 9, 2020

Updated Aug 4, 2024

Link EUVD-2020-30124

GitHub

No data