CVE-2020-13134
Medium
Description
Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are vulnerable to stored XSS. The successful exploitation requires admin privileges (for storing the XSS payload itself), and can exploit (be triggered by) admin users. All TOS versions with SecureChange deployments prior to R19.3 HF3 and R20-1 HF1 are affected. Vulnerabilities were fixed in R19.3 HF3 and R20-1 HF1.
SeverityMedium
CVSS4.8
Exploit probability45. percentile0.5%
ProductTufin Securechange
PublishedJan 20, 2021
First seenJan 20, 2021
How to fix
Update
- tufin securechanger19-3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tufin securechange | v < r19-3, r19-3, r20-1 | r19-3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.