CVE-2020-9300 Missing authorization in Netflix Dispatch
Authenticated users can escalate privileges to admin and view restricted incidents due to missing authorization checks in Netflix Dispatch.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-9300?
CVE-2020-9300 is a medium-severity missing authorization vulnerability in Netflix Dispatch, published on 9 Nov 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Access Control issues include allowing a regular user to view a restricted incident, user role escalation to admin, users adding themselves as a participant in a restricted incident, and users able to view restricted incidents via the search feature. If your install has followed the secure deployment guidelines the risk of this is lowered, as this may only be exploited by an authenticated user.
Which versions are affected by CVE-2020-9300?
It affects 1 product.
Products include Netflix Dispatch.
How do I fix CVE-2020-9300?
No fix has been published for CVE-2020-9300 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-9300 being exploited?
There is no known exploitation of CVE-2020-9300 in the wild and no public exploit code.
Other vulnerabilities in Netflix Dispatch
Sources
Also known as GHSA-64rv-h943-wm6q.