CVE-2020-13175
11.08.2020, 18:15
The Management Interface of the Teradici Cloud Access Connector and Cloud Access Connector Legacy for releases prior to April 20, 2020 (v15 and earlier for Cloud Access Connector) contains a local file inclusion vulnerability which allows an unauthenticated remote attacker to leak LDAP credentials via a specially crafted HTTP request.
| Vendor | Product | Version |
|---|---|---|
| teradici | cloud_access_connector | 𝑥 ≤ 15 |
| teradici | cloud_access_connector_legacy | 𝑥 < 2020-04-20 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-98 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
- CWE-829 - Inclusion of Functionality from Untrusted Control SphereThe software imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.