CVE-2020-35577

6.5 mediumEPSS 1.0%

Medium (6.5) in endalia selection portal. EPSS 1.0% chance of exploitation in the next 30 days.

In Endalia Selection Portal before 4.205.0, an Insecure Direct Object Reference (IDOR) allows any authenticated user to download every file uploaded to the platform by changing the value of the file identifier (aka CommonDownload identification number).

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS: 1.0% chance of exploitation in the next 30 days; higher than 63% of CVEs (scores of 2026-10-31)
Published: 2021-02-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

endalia:selection_portal

References

https://github.com/blackarrowsec/advisories/tree/master/2020/CVE-2020-35577
https://www.endalia.com/en/software/
https://github.com/blackarrowsec/advisories/tree/master/2020/CVE-2020-35577
https://www.endalia.com/en/software/

Check your stack JSON