[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZVlH1F1I5KNHPw8jxPnwjJa-beYh9qoHE86DL7-GNIk":3,"g5a-risk:CVE-2020-27220":111},{"success":4,"data":5,"meta":109},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":39,"epssPercentile":26,"epssTimeSeries":40,"severity":41,"affectedProducts":42,"affectedProductsCount":51,"references":52,"referencesCount":58,"weaknesses":59,"weaknessesCount":58,"isActivelyExploited":68,"cisaInfo":26,"otxData":26,"relatedBlogPosts":69,"seoMetadata":70,"configurations":95,"relatedVendorCves":107,"notableEvents":108},"CVE-2020-27220","What is CVE-2020-27220?","The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & control messages when it has subscribed only to commands for a specific device. The missing check involves verifying that the command target device is configured giving permission for the gateway device to act on its behalf. This means an authenticated device of a certain tenant, notably also a non-gateway device acting like a gateway, may receive command & control messages targeted at a different device of the same tenant without corresponding permissions getting checked.","The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & control messages whe...","2021-01-14T23:15:13.04","2021-01-22T18:34:34.313",8.8,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:L\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H",{"CVSSMetricV31":15,"CVSSMetricV30":26,"CVSSMetricV2":29,"CVSSMetricV40":26},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":27,"ImpactScore":28},"nvd@nist.gov","Primary",{"Version":20,"VectorString":13,"AttackVector":21,"AttackComplexity":22,"PrivilegesRequired":22,"UserInteraction":23,"Scope":24,"ConfidentialityImpact":25,"IntegrityImpact":25,"AvailabilityImpact":25,"BaseScore":12,"BaseSeverity":25,"ExploitCodeMaturity":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"TemporalSeverity":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":25,"ModifiedAttackVector":26,"ModifiedAttackComplexity":26,"ModifiedPrivilegesRequired":26,"ModifiedUserInteraction":26,"ModifiedScope":26,"ModifiedConfidentialityImpact":26,"ModifiedIntegrityImpact":26,"ModifiedAvailabilityImpact":26,"EnvironmentalScore":26,"EnvironmentalSeverity":26},"3.1","NETWORK","LOW","NONE","UNCHANGED","HIGH",null,2.8,5.9,[30],{"Source":17,"Type":18,"CVSSData":31,"BaseSeverity":25,"ExploitabilityScore":37,"ImpactScore":38,"ACInsufInfo":26,"ObtainAllPrivilege":26,"ObtainUserPrivilege":26,"ObtainOtherPrivilege":26,"UserInteractionRequired":26},{"Version":32,"VectorString":33,"AccessVector":21,"AccessComplexity":22,"Authentication":34,"ConfidentialityImpact":35,"IntegrityImpact":35,"AvailabilityImpact":35,"BaseScore":36,"BaseSeverity":26,"Exploitability":26,"RemediationLevel":26,"ReportConfidence":26,"TemporalScore":26,"CollateralDamagePotential":26,"TargetDistribution":26,"ConfidentialityRequirement":26,"IntegrityRequirement":26,"AvailabilityRequirement":26,"EnvironmentalScore":26},"2.0","AV:N\u002FAC:L\u002FAu:S\u002FC:C\u002FI:C\u002FA:C","SINGLE","COMPLETE",9,8,10,0.01161,[39,39,39,39,39,39,39],"High",[43,48],{"vendor":44,"product":45,"version":46,"criteria":47,"vulnerable":4},"eclipse","hono","*","cpe:2.3:a:eclipse:hono:*:*:*:*:*:*:*:*",{"vendor":44,"product":45,"version":49,"criteria":50,"vulnerable":4},"1.5.0","cpe:2.3:a:eclipse:hono:1.5.0:*:*:*:*:*:*:*",2,[53],{"url":54,"source":55,"tags":56},"https:\u002F\u002Fbugs.eclipse.org\u002Fbugs\u002Fshow_bug.cgi?id=569856","Eclipse",[57],"Vendor Advisory",1,[60],{"id":61,"name":62,"description":63,"extendedDescription":64,"status":65,"abstraction":66,"structure":67},"CWE-862","Missing Authorization","The product does not perform an authorization check when an actor attempts to access a resource or perform an action.","Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.\nWhen access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.","Incomplete","Class","Simple",false,[],{"title":71,"metaDescription":72,"keywords":73,"canonicalUrl":74,"structuredData":75},"What is CVE-2020-27220? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2020-27220, a high severity cyber security vulnerability from 2021. The Eclipse Hono AMQP and MQTT protocol adapters do not che...","CVE-2020-27220, CVE-2020-27220 vulnerability, CVE-2020-27220 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2021, CVSS score, exploit, patch, remediation, eclipse security, hono vulnerability","\u002Fwhat-is\u002Fcve-2020-27220",{"@context":76,"@type":77,"headline":71,"description":72,"datePublished":10,"dateModified":11,"author":78,"publisher":82,"about":86,"mainEntityOfPage":90,"articleSection":93,"keywords":94},"https:\u002F\u002Fschema.org","TechArticle",{"@type":79,"name":80,"url":81},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":79,"name":80,"url":81,"logo":83},{"@type":84,"url":85},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":87,"name":6,"description":88,"additionalType":89},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":91,"@id":92},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2020-27220","Cybersecurity","CVE-2020-27220, CVE-2020-27220 vulnerability, CVE-2020-27220 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[96],{"Operator":26,"Negate":26,"Nodes":97},[98],{"Operator":99,"Negate":26,"CPEMatch":100},"OR",[101,105],{"Vulnerable":4,"Criteria":47,"MatchCriteriaID":102,"VersionStartExcluding":26,"VersionStartIncluding":103,"VersionEndExcluding":26,"VersionEndIncluding":104},"9EA7972C-A4C7-4952-9850-6EFC12D23CEB","1.4.0","1.4.4",{"Vulnerable":4,"Criteria":50,"MatchCriteriaID":106,"VersionStartExcluding":26,"VersionStartIncluding":26,"VersionEndExcluding":26,"VersionEndIncluding":26},"BAD15477-6995-4EC3-B9F7-F6D664BD2134",[],[],{"lastModified":11,"cacheTime":110,"version":32},1792275687065,{"score":112,"band":113,"action":114,"scoredAt":115},47,"Medium","Plan remediation","2026-10-16T06:50:17.218613+00:00"]