Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2020-17508

Date: January 11, 2021

The ATS ESI plugin has a memory disclosure vulnerability. If you are running the plugin please upgrade. Apache Traffic Server versions 7.0.0 to 7.1.11 and 8.0.0 to 8.1.0 are affected.

Language: C++

Severity Score

Related Resources (7)

https://people.canonical.com/~ubuntu-security/cve/CVE-2020-17508
https://nvd.nist.gov/vuln/detail/CVE-2020-17508
https://github.com/apache/trafficserver/commit/3113501b3b5acb6b8edd6269c6ffa0b52ef5603b#diff-03700cb0f4ba03f85d4a11acf274c9b63eef3f41b2a68ccb2614b94b85243101
https://security-tracker.debian.org/tracker/CVE-2020-17508
https://github.com/apache/trafficserver/pull/7358/commits/092e4585ee9805db1be74648ca5ec8581d8af3e4?file-filters%5B%5D=
https://lists.apache.org/thread.html/r65434f7acca3aebf81b0588587149c893fe9f8f9f159eaa7364a70ff%40%3Cannounce.trafficserver.apache.org%3E
https://www.mend.io/vulnerability-database/CVE-2020-17508

Severity Score

Weakness Type (CWE)

Exposure of Sensitive Information to an Unauthorized Actor

CWE-200

CVSS v3.1

Base Score:
Attack Vector (AV): NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): NONE

CVSS v2

Base Score:
Access Vector (AV): NETWORK
Access Complexity (AC): LOW
Authentication (AU): NONE
Confidentiality (C): PARTIAL
Integrity (I): NONE
Availability (A): NONE
Additional information:

Do you need more information?

Contact Us