CVE-2020-11918 json
An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14.
published 2024-11-07 2 y ago modified 2026-06-17 4 mo ago also EUVD-2020-4255
- cvss
- 5.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 21%
- public exploits
- 0
- none known
Summary
An issue was discovered in Siime Eye 14.1.00000001.3.330.0.0.3.14. When a backup file is created through the web interface, information on all users, including passwords, can be found in cleartext in the backup file. An attacker capable of accessing the web interface can create the backup file.
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- seclists.org https://seclists.org/fulldisclosure/2024/Jul/14 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 5.4 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| CNA | 3.1 | 5.4 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
Classification
- Weakness
-
- CWE-312 Cleartext Storage of Sensitive Information
References
-
seclists.org
/fulldisclosure/2024/Jul/14
mailing-list, exploit, third-party-advisory
- seclists.org /fulldisclosure/2024/Jul/14
Sources
- CVE List CVE-2020-11918
- NVD CVE-2020-11918
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.