SearchBlox Vulnerabilities and Affected Products
Vulnerabilities associated with SearchBlox.
Products
Clear product- SearchBlox6 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2020-10132MEDIUM | CVE-2020-10132SearchBlox before Version 9.1 is vulnerable to cross-origin resource sharing misconfiguration. CWE-79Sep 6, 2023 | CVSS6.1v3.1 | EPSS0.75% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-10131CRITICAL | CVE-2020-10131SearchBlox before Version 9.2.1 is vulnerable to CSV macro injection in "Featured Results" parameter. CWE-1236Sep 6, 2023 | CVSS9.8v3.1 | EPSS1.52% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-10130HIGH | CVE-2020-10130SearchBlox before Version 9.1 is vulnerable to business logic bypass where the user is able to create multiple super admin users in the system. CWE-639Sep 6, 2023 | CVSS8.8v3.1 | EPSS0.977% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-10129HIGH | CVE-2020-10129SearchBlox before Version 9.2.1 is vulnerable to Privileged Escalation-Lower user is able to access Admin functionality. | CVSS8.8v3.1 | EPSS0.864% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-10128MEDIUM | SearchBlox product before V-9.2.1 is vulnerable to Stored-Cross Site ScriptingSearchBlox product with version before 9.2.1 is vulnerable to stored cross-site scripting at multiple user input parameters. In SearchBlox products multiple parameters are not sanitized/validate properly which allows an attacker to inject malicious JavaScript. CWE-79Sep 5, 2023 | CVSS5.4v3.1 | EPSS0.477% | PoCs1 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2020-35580HIGH | searchblox searchblox Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')A local file inclusion vulnerability in the FileServlet in all SearchBlox before 9.2.2 allows remote, unauthenticated users to read arbitrary files from the operating system via a /searchblox/servlet/FileServlet?col=url= request. Additionally, this may be used to read the contents of the SearchBlox configuration file (e.g., searchblox/WEB-INF/config.xml), which contains both the Super Admin's API key and the base64 encoded SHA1 password hashes of other SearchBlox users. | CVSS7.5v3.1 | EPSS14% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template | STIX |