CVE-2020-10871 Information disclosure in n/a

Medium 5.3 Published 23 Mar 2020 Updated 4 Aug 2024

Remote unauthenticated attackers can retrieve installed packages and services in OpenWrt LuCI, though the vendor disputes the severity.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-10871?

CVE-2020-10871 is a medium-severity vulnerability in n/a, published on 23 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In OpenWrt LuCI git-20.x, remote unauthenticated attackers can retrieve the list of installed packages and services. NOTE: the vendor disputes the significance of this report because, for instances reachable by an unauthenticated actor, the same information is available in other (more complex) ways, and there is no plan to restrict the information further

Weakness: CWE-200

Which versions are affected by CVE-2020-10871?

It affects 1 product.

Products include Openwrt Luci.

How do I fix CVE-2020-10871?

No fix has been published for CVE-2020-10871 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-10871 being exploited?

There is no known exploitation of CVE-2020-10871 in the wild and no public exploit code.

Sources

Also known as GHSA-hcgf-6hm9-4pgw.