# CVE-2020-12695: Server-side request forgery in n/a > Attackers can bypass network segmentation restrictions in UPnP implementations to launch denial-of-service attacks or access internal resources. - **Severity:** High 7.5 (`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:H`) - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 8 Jun 2020 - **Updated:** 4 Aug 2024 - **Also known as:** ALPINE-CVE-2020-12695, ALSA-2021:1789, DEBIAN-CVE-2020-12695, DLA-2315-1, GHSA-wp9w-2vp9-wg66, MGASA-2020-0304, OESA-2022-1768, RHSA-2021:1789, RLSA-2021:1789, UBUNTU-CVE-2020-12695, USN-4494-1 ## What is CVE-2020-12695? CVE-2020-12695 is a high-severity server-side request forgery vulnerability in Canonical Ubuntu Linux, published on 8 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim. ### Official description The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue. Weakness: CWE-276 (Incorrect Default Permissions) ## Which versions are affected by CVE-2020-12695? It affects 217 products. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `gssdp` | AlmaLinux:8 | All versions | 1.0.5-1.el8 | | `gssdp-devel` | AlmaLinux:8 | All versions | 1.0.5-1.el8 | | `gssdp-docs` | AlmaLinux:8 | All versions | 1.0.5-1.el8 | | `gupnp-devel` | AlmaLinux:8 | All versions | 1.0.6-1.el8 | | `gssdp` | Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.5-1.el8 | | `gssdp-debuginfo` | Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.5-1.el8 | | `gssdp-debugsource` | Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.5-1.el8 | | `gssdp-utils-debuginfo` | Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.5-1.el8 | | `gupnp` | Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.6-1.el8 | | `gupnp-debuginfo` | Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.6-1.el8 | | `gupnp-debugsource` | Red Hat:enterprise_linux:8::appstream | All versions | 0:1.0.6-1.el8 | | `gssdp-debuginfo` | Red Hat:enterprise_linux:8::crb | All versions | 0:1.0.5-1.el8 | | `gssdp-debugsource` | Red Hat:enterprise_linux:8::crb | All versions | 0:1.0.5-1.el8 | | `gssdp-devel` | Red Hat:enterprise_linux:8::crb | All versions | 0:1.0.5-1.el8 | | `gssdp-docs` | Red Hat:enterprise_linux:8::crb | All versions | 0:1.0.5-1.el8 | | `gssdp-utils-debuginfo` | Red Hat:enterprise_linux:8::crb | All versions | 0:1.0.5-1.el8 | | `gupnp-debuginfo` | Red Hat:enterprise_linux:8::crb | All versions | 0:1.0.6-1.el8 | | `gupnp-debugsource` | Red Hat:enterprise_linux:8::crb | All versions | 0:1.0.6-1.el8 | | `gupnp-devel` | Red Hat:enterprise_linux:8::crb | All versions | 0:1.0.6-1.el8 | | `gssdp` | Rocky Linux:8 | All versions | 0:1.0.5-1.el8 | Products: Asus Rt-N11, Broadcom Adsl, Canon Selphy Cp1200, Canonical Ubuntu Linux, Cisco Wap131, Cisco Wap150, Cisco Wap351, Debian Debian Linux, Dell B1165nfw, Dlink Dvg-N5412sp, Epson Ep-101, Epson Ew-M970a3t, Epson M571t, Epson Xp-100, Epson Xp-2101, Epson Xp-2105, Epson Xp-241, Epson Xp-320, Epson Xp-330, Epson Xp-340 and 197 more. ## How do I fix CVE-2020-12695? Apply the vendor's patch. ## Is CVE-2020-12695 being exploited? There is no known exploitation of CVE-2020-12695 in the wild and no public exploit code. Public exploit code: - Vulnerability checker for Callstranger (CVE-2020-12695) (github_poc): https://github.com/yunuscadirci/CallStranger - Zeek Plugin that detects CallStranger (CVE-2020-12695) attempts (http://callstranger.com/) (github_poc): https://github.com/corelight/callstranger-detector ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2020-12695 and fix it if it is affected. What it is: CVE-2020-12695 is a high-severity server-side request forgery vulnerability in Canonical Ubuntu Linux, published on 8 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim. Exploitation: There is no known exploitation of CVE-2020-12695 in the wild and no public exploit code. Affected product: Canonical Ubuntu Linux. No package-level version data is available, so check the vendor advisory linked from the reference page. Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2020-12695/ (Markdown: https://insights.sbomify.com/CVE-2020-12695/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2020-12695 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2020-12695 - OSV: https://osv.dev/vulnerability/CVE-2020-12695 --- From sbomify Insights: https://insights.sbomify.com/CVE-2020-12695/ Summaries are generated and may contain mistakes; the official description above is the record.