CVE-2020-11662

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

CA API Developer Portal 4.3.1 and earlier handles requests insecurely, which allows remote attackers to exploit a Cross-Origin Resource Sharing flaw and access sensitive information.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected software

Vendor	Product	Versions
n/a	CA API Developer Portal	4.3.1 and earlier

References

http://packetstormsecurity.com/files/157244/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypass-Privilege-Escalation.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/157276/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypass-Privilege-Escalation.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2020/Apr/24Mailing List, Third Party Advisory
https://techdocs.broadcom.com/us/product-content/status/announcement-documents/2020/CA20200414-01-Securit-Notice-for-CA-API-Developer-Portal.htmlVendor Advisory
http://packetstormsecurity.com/files/157244/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypass-Privilege-Escalation.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/157276/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypass-Privilege-Escalation.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2020/Apr/24Mailing List, Third Party Advisory
https://techdocs.broadcom.com/us/product-content/status/announcement-documents/2020/CA20200414-01-Securit-Notice-for-CA-API-Developer-Portal.htmlVendor Advisory

Timeline

Published: Apr 15, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-116636.1CA API Developer Portal 4.3.1 and earlier handles 404 requests in an insecure manner, which allows attackers to perform open redirect attack CVE-2020-116646.1CA API Developer Portal 4.3.1 and earlier handles homeRedirect page redirects in an insecure manner, which allows attackers to perform open CVE-2020-116656.1CA API Developer Portal 4.3.1 and earlier handles loginRedirect page redirects in an insecure manner, which allows attackers to perform open CVE-2020-116668.8CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows malicious users to elevate privileges.CVE-2020-116687.1In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandles invalid descriptors, CVE-2020-116695.5An issue was discovered in the Linux kernel before 5.2 on the powerpc platform. arch/powerpc/kernel/idle_book3s.S does not have save/restore CVE-2020-11677.8<p>A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory. An attacker who succ CVE-2020-116718.1Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to become CVE-2020-116739.8An issue was discovered in the Responsive Poll through 1.3.4 for Wordpress. It allows an unauthenticated user to manipulate polls, e.g., del CVE-2020-116748.8Cerner medico 26.00 allows variable reuse, possibly causing data corruption.CVE-2020-116758.8Cerner medico 26.00 has a Local Buffer Overflow (issue 1 of 3).CVE-2020-116768.8Cerner medico 26.00 has a Local Buffer Overflow (issue 2 of 3).