CVE-2020-24333

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A vulnerability in Arista’s CloudVision Portal (CVP) prior to 2020.2 allows users with “read-only” or greater access rights to the Configlet Management module to download files not intended for access, located on the CVP server, by accessing a specific API.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.arista.com/en/support/advisories-noticesVendor Advisory
https://www.arista.com/en/support/advisories-notices/security-advisories/11706-security-advisory-51Exploit, Mitigation, Vendor Advisory
https://www.arista.com/en/support/advisories-noticesVendor Advisory
https://www.arista.com/en/support/advisories-notices/security-advisories/11706-security-advisory-51Exploit, Mitigation, Vendor Advisory

Timeline

Published: Sep 22, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-243348.2The code that processes DNS responses in uIP through 1.0, as used in Contiki and Contiki-NG, does not check whether the number of responses CVE-2020-243357.5An issue was discovered in uIP through 1.0, as used in Contiki and Contiki-NG. Domain name parsing lacks bounds checks, allowing an attacker CVE-2020-243369.8An issue was discovered in Contiki through 3.0 and Contiki-NG through 4.5. The code for parsing Type A domain name answers in ip64-dns64.c d CVE-2020-243377.5An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. When an unsupported TCP option with zero length is provided in an incoming CVE-2020-243389.8An issue was discovered in picoTCP through 1.7.0. The DNS domain name record decompression functionality in pico_dns_decompress_name() in pi CVE-2020-243397.5An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The DNS domain name record decompression functionality in pico_dns_decompre CVE-2020-243407.5An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The code that processes DNS responses in pico_mdns_handle_data_as_answers_g CVE-2020-243419.1An issue was discovered in picoTCP and picoTCP-NG through 1.7.0. The TCP input data processing function in pico_tcp.c does not validate the CVE-2020-243427.8Lua through 5.4.0 allows a stack redzone cross in luaO_pushvfstring because a protection mechanism wrongly calls luaD_callnoyield twice in a CVE-2020-243437.8Artifex MuJS through 1.0.7 has a use-after-free in jsrun.c because of unconditional marking in jsgc.c.CVE-2020-243447.1JerryScript through 2.3.0 has a (function({a=arguments}){const arguments}) buffer over-read.CVE-2020-243457.8JerryScript through 2.3.0 allows stack consumption via function a(){new new Proxy(a,{})}JSON.parse("[]",a). NOTE: the vendor states that the