CVE-2020-15809

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

spxmanage on certain SpinetiX devices allows requests that access unintended resources because of SSRF and Path Traversal. This affects HMP350, HMP300, and DiVA through 4.5.2-1.0.36229; HMP400 and HMP400W through 4.5.2-1.0.2-1eb2ffbd; and DSOS through 4.5.2-1.0.2-1eb2ffbd.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22 CWE-918

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://support.spinetix.com/wiki/DSOS_release_notesRelease Notes, Vendor Advisory
https://support.spinetix.com/wiki/SpinetiX-SA-20:01Release Notes, Vendor Advisory
https://support.spinetix.com/wiki/DSOS_release_notesRelease Notes, Vendor Advisory
https://support.spinetix.com/wiki/SpinetiX-SA-20:01Release Notes, Vendor Advisory

Timeline

Published: Mar 24, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-15817.8An elevation of privilege vulnerability exists in the way that Microsoft Office Click-to-Run (C2R) components handle objects in memory. An a CVE-2020-158106.5An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Smuggling attacks may succ CVE-2020-158116.5An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succ CVE-2020-158138.1Graylog before 3.3.3 lacks SSL Certificate Validation for LDAP servers. It allows use of an external user/group database stored in LDAP. The CVE-2020-158168.8In Western Digital WD Discovery before 4.0.251.0, a malicious application running with standard user permissions could potentially execute c CVE-2020-158178.8In JetBrains YouTrack before 2020.1.1331, an external user could execute commands against arbitrary issues.CVE-2020-158185.3In JetBrains YouTrack before 2020.2.8527, the subtasks workflow could disclose issue existence.CVE-2020-158195.3JetBrains YouTrack before 2020.2.10643 was vulnerable to SSRF that allowed scanning internal ports.CVE-2020-15827.8A remote code execution vulnerability exists in Microsoft Access software when the software fails to properly handle objects in memory. An a CVE-2020-158205.3In JetBrains YouTrack before 2020.2.6881, the markdown parser could disclose hidden file existence.CVE-2020-158216.5In JetBrains YouTrack before 2020.2.6881, a user without permission is able to create an article draft.CVE-2020-158227.3In JetBrains YouTrack before 2020.2.10514, SSRF is possible because URL filtering can be escaped.