CVE-2020-14341
Low
Description
The "Test Connection" available in v7.x of the Red Hat Single Sign On application console can permit an authorized user to cause SMTP connections to be attempted to arbitrary hosts and ports of the user's choosing, and originating from the RHSSO installation. By observing differences in the timings of these scans, an attacker may glean information about hosts and ports which they do not have access to scan directly.
SeverityLow
CVSS2.7
Exploit probability62. percentile1%
Product
Redhat Single Sign-on
PublishedJan 12, 2021
First seenJan 12, 2021
Weakness typeCWE-385CWE-385
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat single_sign-on | 7.0 ≤ v ≤ 7.4 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.