CVE-2020-11665

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

CA API Developer Portal 4.3.1 and earlier handles loginRedirect page redirects in an insecure manner, which allows attackers to perform open redirect attacks.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
n/a	CA API Developer Portal	4.3.1 and earlier

References

http://packetstormsecurity.com/files/157244/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypass-Privilege-Escalation.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/157276/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypass-Privilege-Escalation.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2020/Apr/24Mailing List, Third Party Advisory
https://techdocs.broadcom.com/us/product-content/status/announcement-documents/2020/CA20200414-01-Securit-Notice-for-CA-API-Developer-Portal.htmlVendor Advisory
http://packetstormsecurity.com/files/157244/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypass-Privilege-Escalation.htmlThird Party Advisory, VDB Entry
http://packetstormsecurity.com/files/157276/CA-API-Developer-Portal-4.2.x-4.3.1-Access-Bypass-Privilege-Escalation.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2020/Apr/24Mailing List, Third Party Advisory
https://techdocs.broadcom.com/us/product-content/status/announcement-documents/2020/CA20200414-01-Securit-Notice-for-CA-API-Developer-Portal.htmlVendor Advisory

Timeline

Published: Apr 15, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-116668.8CA API Developer Portal 4.3.1 and earlier contains an access control flaw that allows malicious users to elevate privileges.CVE-2020-116687.1In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xirlink_cit.c (aka the Xirlink camera USB driver) mishandles invalid descriptors, CVE-2020-116695.5An issue was discovered in the Linux kernel before 5.2 on the powerpc platform. arch/powerpc/kernel/idle_book3s.S does not have save/restore CVE-2020-11677.8<p>A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory. An attacker who succ CVE-2020-116718.1Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to become CVE-2020-116739.8An issue was discovered in the Responsive Poll through 1.3.4 for Wordpress. It allows an unauthenticated user to manipulate polls, e.g., del CVE-2020-116748.8Cerner medico 26.00 allows variable reuse, possibly causing data corruption.CVE-2020-116758.8Cerner medico 26.00 has a Local Buffer Overflow (issue 1 of 3).CVE-2020-116768.8Cerner medico 26.00 has a Local Buffer Overflow (issue 2 of 3).CVE-2020-116778.8Cerner medico 26.00 has a Local Buffer Overflow (issue 3 of 3).CVE-2020-116798.8Castel NextGen DVR v1.0.0 is vulnerable to privilege escalation through the Adminstrator/Users/Edit/:UserId functionality. Adminstrator/User CVE-2020-116806.5Castel NextGen DVR v1.0.0 is vulnerable to authorization bypass on all administrator functionality. The application fails to check that a re