CVE-2020-5281

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Perun before version 3.9.1, VO or group manager can modify configuration of the LDAP extSource to retrieve all from Perun LDAP. Issue is fixed in version 3.9.1 by sanitisation of the input.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-90 CWE-732

Affected software

Vendor	Product	Versions
CESNET	perun	< 3.9.1

References

https://github.com/CESNET/perun/commit/ac527bc3225a64208ee5cee59e5918ee360ca039Patch, Third Party Advisory
https://github.com/CESNET/perun/pull/2635Patch, Third Party Advisory
https://github.com/CESNET/perun/security/advisories/GHSA-gj88-9q3f-72m3Third Party Advisory
https://github.com/CESNET/perun/commit/ac527bc3225a64208ee5cee59e5918ee360ca039Patch, Third Party Advisory
https://github.com/CESNET/perun/pull/2635Patch, Third Party Advisory
https://github.com/CESNET/perun/security/advisories/GHSA-gj88-9q3f-72m3Third Party Advisory

Timeline

Published: Mar 25, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-52829.8In Nick Chan Bot before version 1.0.0-beta there is a vulnerability in the `npm` command which is part of this software package. This allows CVE-2020-52833.5ViewVC before versions 1.1.28 and 1.2.1 has a XSS vulnerability in CVS show_subdir_lastmod support. The impact of this vulnerability is miti CVE-2020-52844.3Next.js versions before 9.3.2 have a directory traversal vulnerability. Attackers could craft special requests to access files in the dist d CVE-2020-52856.1In PrestaShop between versions 1.7.6.0 and 1.7.6.5, there is a reflected XSS with `back` parameter. The problem is fixed in 1.7.6.5 CVE-2020-52866.1In PrestaShop between versions 1.7.4.0 and 1.7.6.5, there is a reflected XSS when uploading a wrong file. The problem is fixed in 1.7.6.5 CVE-2020-52876.5In PrestaShop between versions 1.5.5.0 and 1.7.6.5, there is improper access control on customers search. The problem is fixed in 1.7.6.5.CVE-2020-52886.5"In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there is improper access controls on product attributes page. The problem is fixed in 1 CVE-2020-52896.5In Elide before 4.5.14, it is possible for an adversary to "guess and check" the value of a model field they do not have access to assuming CVE-2020-52906.5In RedpwnCTF before version 2.3, there is a session fixation vulnerability in exploitable through the `#token=$ssid` hash when making a requ CVE-2020-52917.8Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the `bwrap -CVE-2020-52928.8Leantime before versions 2.0.15 and 2.1-beta3 has a SQL Injection vulnerability. The impact is high. Malicious users/attackers can execute a CVE-2020-52936.5In PrestaShop between versions 1.7.0.0 and 1.7.6.5, there are improper access controls on product page with combinations, attachments and sp