CVE-2020-15087 : Vulnerability Insights and Analysis
Learn about CVE-2020-15087, a privilege escalation vulnerability in Presto before version 337. Understand the impact, affected systems, exploitation mechanism, and mitigation steps to secure your Presto installations.
In Presto before version 337, authenticated users can bypass authorization checks by directly accessing internal APIs. This impacts Presto server installations with secure internal communication configured. Learn more about the impact, technical details, and mitigation steps for this vulnerability.
Understanding CVE-2020-15087
This CVE involves a privilege escalation vulnerability in Presto that allows authenticated users to bypass authorization checks by accessing internal APIs.
What is CVE-2020-15087?
The vulnerability in Presto before version 337 enables authenticated users to circumvent authorization checks by directly accessing internal APIs. This issue affects Presto server installations with secure internal communication configured.
The Impact of CVE-2020-15087
- Confidentiality Impact: High
- Base Score: 7.4 (High)
- Scope: Changed
- User Interaction: Required
- Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Technical Details of CVE-2020-15087
This section provides more in-depth technical information about the vulnerability.
Vulnerability Description
The vulnerability allows authenticated users to bypass authorization checks by accessing internal APIs in Presto versions prior to 337.
Affected Systems and Versions
- Affected Product: Presto
- Vendor: prestosql
- Affected Versions: < 337
Exploitation Mechanism
The issue arises from a lack of proper authorization checks, enabling users to access internal APIs directly.
Mitigation and Prevention
Protect your systems from CVE-2020-15087 with these mitigation strategies.
Immediate Steps to Take
- Update Presto to version 337 or later to fix the vulnerability.
- Block network access to internal APIs on the coordinator and workers.
Long-Term Security Practices
- Regularly update Presto and other software to the latest versions.
- Implement secure communication practices within your Presto server installations.
Patching and Updates
Ensure timely patching and updates to address security vulnerabilities in Presto installations.