CVE-2020-15235
About
In RACTF before commit f3dc89b, unauthenticated users are able to get the value of sensitive config keys that would normally be hidden to everyone except admins. All versions after commit f3dc89b9f6ab1544a289b3efc06699b13d63e0bd(3/10/20) are patched.
Rainforest analyst review
Unauthenticated users of RACTF can read the values of sensitive configuration keys that are supposed to be admin-only. It's an information-disclosure bug, no code execution, but the disclosed material is exactly the kind of secret that shouldn't be world-readable.
The higher attack complexity in the vector suggests some condition has to line up rather than it being a trivial one-shot, and RACTF is a niche CTF platform, so the installed base is small. The consequence to weigh is second-order: whatever secrets sit in those config keys, API tokens, credentials, may unlock further access once leaked.
Given the narrow footprint, we prioritize this by whether the platform is actually deployed and internet-reachable. Where it is, the right posture is to treat any exposed config secrets as compromised and rotate them, rather than assuming a version bump alone closes the loop.
References
Related CVEs
Frequently asked questions
What is CVE-2020-15235?
In RACTF before commit f3dc89b, unauthenticated users are able to get the value of sensitive config keys that would normally be hidden to everyone except admins. All versions after commit f3dc89b9f6ab1544a289b3efc06699b13d63e0bd(3/10/20) are patched.
How severe is CVE-2020-15235?
CVE-2020-15235 carries a CVSS 3.1 base score of 5.9, rated medium. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 66 out of 100, in the elevated band.
How is CVE-2020-15235 exploited?
According to the CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N): attack vector Network, attack complexity High, privileges required None, user interaction None. Impact on confidentiality High, integrity None and availability None.
Which products are affected by CVE-2020-15235?
Public advisories list the following as affected: core. Check the references on this page for the exact versions each vendor confirms.
How do I fix CVE-2020-15235?
Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.
Empower Your Security Strategy with Rainforest
Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.