CVE-2020-8761

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

Inadequate encryption strength in subsystem for Intel(R) CSME versions before 13.0.40 and 13.30.10 may allow an unauthenticated user to potentially enable information disclosure via physical access.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-326

Affected software

Vendor	Product	Versions
n/a	Intel(R) CSME	versions before 13.0.40 and 13.30.10

References

https://security.netapp.com/advisory/ntap-20201113-0002/Third Party Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00391Vendor Advisory
https://security.netapp.com/advisory/ntap-20201113-0002/Third Party Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00391Vendor Advisory

Timeline

Published: Nov 12, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-87637.8Improper permissions in the installer for the Intel(R) RealSense(TM) D400 Series UWP driver for Windows* 10 may allow an authenticated user CVE-2020-87646.7Improper access control in BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privil CVE-2020-87656.7Incorrect default permissions in the installer for the Intel(R) RealSense(TM) DCM may allow a privileged user to potentially enable escalati CVE-2020-87666.5Improper conditions check in the Intel(R) SGX DCAP software before version 1.6 may allow an unauthenticated user to potentially enable denia CVE-2020-87675.5Uncaught exception in the Intel(R) 50GbE IP Core for Intel(R) Quartus Prime before version 20.2 may allow an authenticated user to potential CVE-2020-87689.4An issue was discovered on Phoenix Contact Emalytics Controller ILC 2050 BI before 1.2.3 and BI-L before 1.2.3 devices. There is an insecure CVE-2020-87719.8The Time Capsule plugin before 1.21.16 for WordPress has an authentication bypass. Any request containing IWP_JSON_PREFIX causes the client CVE-2020-87729.8The InfiniteWP Client plugin before 1.9.4.5 for WordPress has a missing authorization check in iwp_mmb_set_request in init.php. Any attacker CVE-2020-87738.9The Richtext Editor in Pega Platform before 8.2.6 is affected by a Stored Cross-Site Scripting (XSS) vulnerability.CVE-2020-87748.8Pega Platform before version 8.2.6 is affected by a Reflected Cross-Site Scripting vulnerability in the "ActionStringID" function.CVE-2020-87758.9Pega Platform before version 8.2.6 is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the comment tags.CVE-2020-87765.4Alfresco Enterprise before 5.2.7 and Alfresco Community before 6.2.0 (rb65251d6-b368) has XSS via the URL property of a file.