CVE-2020-35584

Description

In Solstice Pod before 3.0.3, the web services allow users to connect to them over unencrypted channels via the Browser Look-in feature. An attacker suitably positioned to view a legitimate user's network traffic could record and monitor their interactions with the web services and obtain any information the user supplies, including Administrator passwords and screen keys.

Weakness classification

• nvd@nist.gov: CWE-319

Primary references

• cve@mitre.org — Release Notes, Vendor Advisory
• cve@mitre.org — Exploit, Third Party Advisory
• cve@mitre.org — Product, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Product, Vendor Advisory