CVE-2020-13134: tufin securechange

csirt@kutim:~/threat-intel/cve/CVE-2020-13134

CVSS 4.8 · Medium EPSS 0,52%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada tufin securechange. Skor CVSS 3.1 4.8 (Medium) menurut NVD.

Deskripsi (NVD)

Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are vulnerable to stored XSS. The successful exploitation requires admin privileges (for storing the XSS payload itself), and can exploit (be triggered by) admin users. All TOS versions with SecureChange deployments prior to R19.3 HF3 and R20-1 HF1 are affected. Vulnerabilities were fixed in R19.3 HF3 and R20-1 HF1.

Rincian

Terbit di NVD: 20 Januari 2021
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 4.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari): 0,52% peluang dieksploitasi; lebih tinggi dari 42,6% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
tufin	securechange	Semua versi sebelum r19-3
tufin	securechange	Versi r19-3
tufin	securechange	Versi r20-1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md advisory pihak ketiga
https://portal.tufin.com/aspx/SecurityAdvisories permissions required

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.