Read the docs
TI-2020-10354 Aliases CVE-2020-13176GHSA-pqv9-ggw2-j3fm

Cross-site scripting in - Cloud Access Connector - Cloud Access Connector Legacy

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 24, 2020 (v16 and earlier for the Cloud Access Connector) contains a stored cross-site scripting (XSS) vulnerability which allows a remote unauthenticated attacker to poison log files with malicious JavaScript via the login page which is executed when an administrator views the logs within the application.

Why it matters now

EPSS 0.00833 57th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—- Cloud Access Connector - Cloud Access Connector LegacyCloud Access Connector Legacy prior to April 24, 2020, Cloud Access Connector, v16 and earlier)—No fix listedCNA
  • - Cloud Access Connector - Cloud Access Connector Legacy Vendor— Affected Cloud Access Connector Legacy prior to April 24, 2020, Cloud Access Connector, v16 and earlier) Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:teradici:cloud_access_connector:*:*:*:*:*:*:*:*up to 16VulnerableTeradici
cpe:2.3:a:teradici:cloud_access_connector_legacy:*:*:*:*:*:*:*:*before 2020-04-24VulnerableTeradici
  • cpe:2.3:a:teradici:cloud_access_connector:*:*:*:*:*:*:*:* Versions up to 16 Vulnerable ·Teradici
  • cpe:2.3:a:teradici:cloud_access_connector_legacy:*:*:*:*:*:*:*:* Versions before 2020-04-24 Vulnerable ·Teradici

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-13176
  2. 2026-10-03 Alias added: GHSA-pqv9-ggw2-j3fm

References

Advisory 1

  • TI-2020-10353 The Management Interface of the Teradici Cloud Access Connector and Cloud Access… CVSS 3.1HIGH 7.5
  • TI-2020-10359 Authentication bypass in - Cloud Access Connector - Cloud Access Connector Legacy CVSS 3.1MEDIUM 6.5
  • TI-2020-10360 Cross-site request forgery in - Cloud Access Connector - Cloud Access Connector Legacy CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences