CVE-2020-24641

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Aruba AirWave Glass before 1.3.3, there is a Server-Side Request Forgery vulnerability through an unauthenticated endpoint that if successfully exploited can result in disclosure of sensitive information. This can be used to perform an authentication bypass and ultimately gain administrative access on the web administrative interface.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-287 CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Jan 15, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-246469.8A tftpserver stack-based buffer overflow remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) versi CVE-2020-246479.8A remote accessmgrservlet classname input validation code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) CVE-2020-246489.8A accessmgrservlet classname deserialization of untrusted data remote code execution vulnerability was discovered in HPE Intelligent Managem CVE-2020-246499.8A remote bytemessageresource transformentity" input validation code execution vulnerability was discovered in HPE Intelligent Management Cen CVE-2020-246509.8A legend expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version CVE-2020-246519.8A syslogtempletselectwin expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Cent CVE-2020-246529.8A addvsiinterfaceinfo expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center CVE-2020-246539.8secure-store in Expo through 2.16.1 on iOS provides the insecure kSecAttrAccessibleAlwaysThisDeviceOnly policy when WHEN_UNLOCKED_THIS_DEVIC CVE-2020-246543.3In KDE Ark before 20.08.1, a crafted TAR archive with symlinks can install files outside the extraction directory, as demonstrated by a writ CVE-2020-246555.1A race condition in the Twilio Authy 2-Factor Authentication application before 24.3.7 for Android allows a user to potentially approve/deny CVE-2020-246566.5Maltego before 4.2.12 allows XXE attacks.CVE-2020-246587.8Arm Compiler 5 through 5.06u6 has an error in a stack protection feature designed to help spot stack-based buffer overflows in local arrays.