Red Hat Interchange vulnerabilities

3 CVEs affecting Red Hat Interchange, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-12685, published 2020-05-15.

More from Red Hat.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2002-0874, published 2002-09-05. Medium severity, CVSS 5.0. EPSS: 5.8% chance of exploitation in the next 30 days. Vulnerability in Interchange 4.8.6, 4.8.3, and other versions, when running in INET mode, allows remote attackers to read arbitrary files.
• CVE-2003-1138, published 2003-10-27. Medium severity, CVSS 5.0. EPSS: 5.4% chance of exploitation in the next 30 days. The default configuration of Apache 2.0.40, as shipped with Red Hat Linux 9.0, allows remote attackers to list directory contents, even if auto indexing is turned off and there is a default web page…
• CVE-2020-12685, published 2020-05-15. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. XSS in the admin help system admin/help.html and admin/quicklinks.html in Interchange 4.7.0 through 5.11.x allows remote attackers to steal credentials or data via browser JavaScript.