CVE-2020-11658

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

CA API Developer Portal 4.3.1 and earlier handles shared secret keys in an insecure manner, which allows attackers to bypass authorization.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Apr 15, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-116594.3CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows privileged users to perform a restricted user administCVE-2020-11667.8An elevation of privilege vulnerability exists when Windows improperly handles calls to Clipboard Service. An attacker who successfully explCVE-2020-116606.5CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows privileged users to view restricted sensitive informatCVE-2020-116618.1CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows privileged users to view and edit user data.CVE-2020-116627.5CA API Developer Portal 4.3.1 and earlier handles requests insecurely, which allows remote attackers to exploit a Cross-Origin Resource SharCVE-2020-116636.1CA API Developer Portal 4.3.1 and earlier handles 404 requests in an insecure manner, which allows attackers to perform open redirect attackCVE-2020-116646.1CA API Developer Portal 4.3.1 and earlier handles homeRedirect page redirects in an insecure manner, which allows attackers to perform open CVE-2020-116656.1CA API Developer Portal 4.3.1 and earlier handles loginRedirect page redirects in an insecure manner, which allows attackers to perform openCVE-2020-116668.8CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows malicious users to elevate privileges.CVE-2020-116687.1In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandles invalid descriptors, CVE-2020-116695.5An issue was discovered in the Linux kernel before 5.2 on the powerpc platform. arch/powerpc/kernel/idle_book3s.S does not have save/restoreCVE-2020-11677.8<p>A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory. An attacker who succ