CVE-2020-12695 Server-side request forgery in n/a
Attackers can bypass network segmentation restrictions in UPnP implementations to launch denial-of-service attacks or access internal resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-12695?
CVE-2020-12695 is a high-severity server-side request forgery vulnerability in Canonical Ubuntu Linux, published on 8 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.
Weakness: CWE-276
Which versions are affected by CVE-2020-12695?
It affects 217 products.
Linux distribution packages (20)
gssdp AlmaLinux:8 | All versions | 1.0.5-1.el8 |
gssdp-devel AlmaLinux:8 | All versions | 1.0.5-1.el8 |
gssdp-docs AlmaLinux:8 | All versions | 1.0.5-1.el8 |
gupnp-devel AlmaLinux:8 | All versions | 1.0.6-1.el8 |
gssdp Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.5-1.el8 |
gssdp-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.5-1.el8 |
gssdp-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.5-1.el8 |
gssdp-utils-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.5-1.el8 |
gupnp Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.6-1.el8 |
gupnp-debuginfo Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.6-1.el8 |
gupnp-debugsource Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.6-1.el8 |
gssdp-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:1.0.5-1.el8 |
gssdp-debugsource Red Hat:enterprise_linux:8::crb | All versions | 0:1.0.5-1.el8 |
gssdp-devel Red Hat:enterprise_linux:8::crb | All versions | 0:1.0.5-1.el8 |
gssdp-docs Red Hat:enterprise_linux:8::crb | All versions | 0:1.0.5-1.el8 |
gssdp-utils-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:1.0.5-1.el8 |
gupnp-debuginfo Red Hat:enterprise_linux:8::crb | All versions | 0:1.0.6-1.el8 |
gupnp-debugsource Red Hat:enterprise_linux:8::crb | All versions | 0:1.0.6-1.el8 |
gupnp-devel Red Hat:enterprise_linux:8::crb | All versions | 0:1.0.6-1.el8 |
gssdp Rocky Linux:8 | All versions | 0:1.0.5-1.el8 |
Products include Asus Rt-N11, Broadcom Adsl, Canon Selphy Cp1200, Canonical Ubuntu Linux, Cisco Wap131, Cisco Wap150 and 211 more.
How do I fix CVE-2020-12695?
Apply the vendor's patch.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2020-12695 being exploited?
There is no known exploitation of CVE-2020-12695 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Sources
Also known as ALPINE-CVE-2020-12695, ALSA-2021:1789, DEBIAN-CVE-2020-12695, DLA-2315-1, GHSA-wp9w-2vp9-wg66, MGASA-2020-0304 and 5 more.