Medium severity · published Dec 7, 2020
CVE-2020-26513
An issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4
5.5
CVSS
0.9%
EPSS
No
On KEV
Description
An issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4. The ReqIF XML data, used by the codebeamer ALM application to import projects, is parsed by insecurely configured software components, which can be abused for XML External Entity Attacks.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Codebeamer · Intland
10.0.0 before 10.1.0; 10.1.0; 10.1.0; 10.1.0; 10.1.0; 10.1.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-26513
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-26513
Exploit
https://compass-security.com/fileadmin/Research/Advisories/2020-09_CSNC-2020-008_Intland_codeBeamer_ALM_XXE.txt
Product
https://intland.com/codebeamer/application-lifecycle-management/
More from Codebeamer
8.8
CVE-2020-26516
A CSRF issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4
7.5
CVE-2020-26515
An insufficiently protected credentials issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4
6.1
CVE-2023-4296
If an attacker tricks an admin user of PTC Codebeamer into clicking on a malicious link, it may allow the attacker to inject arbitrary code to be executed in the browser on the…
6.1
CVE-2019-20635
codeBeamer before 9.5.0-RC3 does not properly restrict the ability to execute custom Java code and access the Java class loader via computed fields
4.8
CVE-2020-26517
A cross-site scripting (XSS) issue was discovered in Intland codeBeamer ALM 10.x through 10.1.SP4