Vulnerabilities

TI-2020-12562 CVE-2020-15950 · GHSA-4cx2-827f-fp6c

Immuta v2.8.2 is affected by improper session management: user sessions are not revoked upon logout.

MEDIUM 41

Immuta v2.8.2 is affected by improper session management: user sessions are not revoked upon logout.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01314 Published 2020-11-05 No fix listed CWE-613

TI-2020-12561 CVE-2020-15949 · GHSA-m5wp-9jw2-r9vp

Immuta v2.8.2 is affected by one instance of insecure permissions that can lead to user account takeover.

LOW 35

Immuta v2.8.2 is affected by one instance of insecure permissions that can lead to user account takeover.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01285 Published 2020-11-05 No fix listed CWE-287

TI-2020-12563 CVE-2020-15951 · GHSA-qwjj-3fhx-p5hh

Immuta v2.8.2 accepts user-supplied project names without properly sanitizing the input…

LOW 29

Immuta v2.8.2 accepts user-supplied project names without properly sanitizing the input, allowing attackers to inject arbitrary HTML content that is rendered as part of the application.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00968 Published 2020-11-05 No fix listed CWE-79

TI-2020-12564 CVE-2020-15952 · GHSA-6vmv-5g75-qpqc

Immuta v2.8.2 is affected by stored XSS that allows a low-privileged user to escalate…

MEDIUM 43

Immuta v2.8.2 is affected by stored XSS that allows a low-privileged user to escalate privileges to administrative permissions.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.02003 Published 2020-11-05 No fix listed CWE-79

Vulnerabilities

Filters

Immuta v2.8.2 is affected by improper session management: user sessions are not revoked upon logout.

Immuta v2.8.2 is affected by one instance of insecure permissions that can lead to user account takeover.

Immuta v2.8.2 accepts user-supplied project names without properly sanitizing the input…

Immuta v2.8.2 is affected by stored XSS that allows a low-privileged user to escalate…