CVE-2020-13185

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Certain web application pages in the authenticated section of the Teradici Cloud Access Connector prior to v18 were accessible without the need to specify authentication tokens, which allowed an attacker in the ability to execute sensitive functions without credentials.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-288 CWE-287

Affected software

Vendor	Product	Versions
n/a	- Cloud Access Connector - Cloud Access Connector Legacy	v18 and earlier

References

https://advisory.teradici.com/security-advisories/69/Release Notes, Vendor Advisory
https://advisory.teradici.com/security-advisories/69/Release Notes, Vendor Advisory

Timeline

Published: Feb 11, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-131866.5An Anti CSRF mechanism was discovered missing in the Teradici Cloud Access Connector v31 and earlier in a specific web form, which allowed a CVE-2020-13197.3<p>A remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory. An attacker who CVE-2020-13205.4A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web reques CVE-2020-13218.8A remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory, aka 'Microsoft CVE-2020-13226.5An information disclosure vulnerability exists when Microsoft Project reads out of bound memory due to an uninitialized variable, aka 'Micro CVE-2020-132237.5HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials. Fixed in 1.3.6 and CVE-2020-132248.8TP-LINK NC200 devices through 2.1.10 build 200401, NC210 devices through 1.0.10 build 200401, NC220 devices through 1.3.1 build 200401, NC23 CVE-2020-132254.8phpIPAM 1.4 contains a stored cross site scripting (XSS) vulnerability within the Edit User Instructions field of the User Instructions widg CVE-2020-132269.8WSO2 API Manager 3.0.0 does not properly restrict outbound network access from a Publisher node, opening up the possibility of SSRF to this CVE-2020-132275.3An issue was discovered in Sysax Multi Server 6.90. An attacker can determine the username (under which the web server is running) by trigge CVE-2020-132286.1An issue was discovered in Sysax Multi Server 6.90. There is reflected XSS via the /scgi sid parameter.CVE-2020-132298.8An issue was discovered in Sysax Multi Server 6.90. A session can be hijacked if one observes the sid value in any /scgi URI, because it is