CVE-2020-13461

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Username enumeration in present in Tufin SecureTrack. It's affecting all versions of SecureTrack. The vendor has decided not to fix this vulnerability. Vendor's response: "This attack requires access to the internal network. If an attacker is part of the internal network, they do not require access to TOS to know the usernames".

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published
Feb 9, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-134625.7Insecure Direct Object Reference (IDOR) exists in Tufin SecureChange, affecting all versions prior to R20-2 GA. Fixed in version R20-2 GA.CVE-2020-134634.6The flash memory readout protection in Apex Microelectronics APM32F103 devices allows physical attackers to extract firmware via the debug iCVE-2020-134644.2The flash memory readout protection in China Key Systems & Integrated Circuit CKS32F103 devices allows physical attackers to extract firmwarCVE-2020-134656.8The security protection in Gigadevice GD32F103 devices allows physical attackers to redirect the control flow and execute arbitrary code viaCVE-2020-134666.8STMicroelectronics STM32F103 devices through 2020-05-20 allow physical attackers to execute arbitrary code via a power glitch and a specificCVE-2020-134674.6The flash memory readout protection in China Key Systems & Integrated Circuit CKS32F103 devices allows physical attackers to extract firmwarCVE-2020-134686.8Gigadevice GD32F130 devices allow physical attackers to escalate their debug interface permissions via fault injection into inter-IC bondingCVE-2020-134694.6The flash memory readout protection in Gigadevice GD32VF103 devices allows physical attackers to extract firmware via the debug interface byCVE-2020-13477.8An elevation of privilege vulnerability exists when the Windows Storage Services improperly handle file operations, aka 'Windows Storage SerCVE-2020-134704.6Gigadevice GD32F103 and GD32F130 devices allow physical attackers to extract data via the probing of easily accessible bonding wires and de-CVE-2020-134716.8Apex Microelectronics APM32F103 devices allow physical attackers to execute arbitrary code via a power glitch and a specific flash patch/breCVE-2020-134724.6The flash memory readout protection in Gigadevice GD32F103 devices allows physical attackers to extract firmware via the debug interface by
CVE-2020-13461: Medium severity, CVSS 4.3 | Vulnix