Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2020-11590: An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP GET request to HealthPage.aspx and obtain the internal server name.
CVE-2020-11590 · published 6 years ago
Summary
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP GET request to HealthPage.aspx and obtain the internal server name.
What to do
- Update cipplanner cipace to version 9.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| cipplanner | cipace |
< 9.1 cpe:2.3:a:cipplanner:cipace:*:*:*:*:*:*:*:* |
Original advisory text
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP GET request to HealthPage.aspx and obtain the internal server name.
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP GET request to HealthPage.aspx and obtain the internal server name.
References
- https://www.criticalstart.com/vulnerabilities-discovered-in-cipace-enterprise-pl... Exploit Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published6 Apr 2020
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2020-11590 · NVD
Track software like this
Free during beta