Read the docs
TI-2020-10352 Aliases CVE-2020-13174GHSA-8fr8-vvgp-v7f5

Clickjacking in - Management Console

Priority LOW 28CWE-1021Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-1021.

Summary

The web server in the Teradici Managament console versions 20.04 and 20.01.1 did not properly set the X-Frame-Options HTTP header, which could allow an attacker to trick a user into clicking a malicious link via clickjacking.

Why it matters now

EPSS 0.00661 51st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—- Management Console20.04 and 20.01.1—No fix listedCNA
  • - Management Console Vendor— Affected 20.04 and 20.01.1 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:teradici:pcoip_management_console:20.01.1:*:*:*:*:*:*:*20.01.1VulnerableTeradici
cpe:2.3:a:teradici:pcoip_management_console:20.04:*:*:*:*:*:*:*20.04VulnerableTeradici
  • cpe:2.3:a:teradici:pcoip_management_console:20.01.1:*:*:*:*:*:*:* Versions 20.01.1 Vulnerable ·Teradici
  • cpe:2.3:a:teradici:pcoip_management_console:20.04:*:*:*:*:*:*:* Versions 20.04 Vulnerable ·Teradici

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-13174
  2. 2026-10-03 Alias added: GHSA-8fr8-vvgp-v7f5
  3. 2026-10-07 EPSS moved to the 50th–90th percentile

References

Patch 1

  • TI-2017-14187 Teradici Management Console Database Management privileges management CVSS 3.1HIGH 7.8
  • TI-2020-08842 Teradici PCoIP Management Console 20.01.0 and 19.11.1 is vulnerable to unauthenticated… CVSS 3.1HIGH 8.1
  • TI-2021-14205 In Teradici PCoIP Management Console-Enterprise 20.07.0, an unauthenticated user can… CVSS 3.1MEDIUM 6.1
  • TI-2020-10358 Cross-site scripting in Teradici PCoIP Management Console CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences