CVE-2020-15110

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

In jupyterhub-kubespawner before 0.12, certain usernames will be able to craft particular server names which will grant them access to the default server of other users who have matching usernames. This has been fixed in 0.12.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Jul 17, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-151115.4In Fiber before version 1.12.6, the filename that is given in c.Attachment() (https://docs.gofiber.io/ctx#attachment) is not escaped, and thCVE-2020-151126.5In etcd before versions 3.3.23 and 3.4.10, it is possible to have an entry index greater then the number of entries in the ReadAll method inCVE-2020-151137.1In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created (etcd data directory and the directory path when provided to CVE-2020-151147.7In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, CVE-2020-151157.5etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as thoseCVE-2020-151176.5In Synergy before version 1.12.0, a Synergy server can be crashed by receiving a kMsgHelloBack packet with a client name length set to 0xfffCVE-2020-151185.4In Wagtail before versions 2.7.4 and 2.9.3, when a form page type is made available to Wagtail editors through the `wagtail.contrib.forms` aCVE-2020-151195.4In auth0-lock versions before and including 11.25.1, dangerouslySetInnerHTML is used to update the DOM. When dangerouslySetInnerHTML is usedCVE-2020-15127.8An information disclosure vulnerability exists when the Windows State Repository Service improperly handles objects in memory. An attacker wCVE-2020-151204.9In "I hate money" before version 4.1.5, an authenticated member of one project can modify and delete members of another project, without knoCVE-2020-151219.6In radare2 before version 4.5.0, malformed PDB file names in the PDB server path cause shell injection. To trigger the problem it's requiredCVE-2020-151239.3In codecov (npm package) before version 3.7.1 the upload method has a command injection vulnerability. Clients of the codecov-node library a
CVE-2020-15110: High severity, CVSS 8.1 | Vulnix