What’s Vulnerable › Vulnerabilities

CVE-2020-13134

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-01-20 · updated 2026-06-17
• Weakness: CWE-79

Description

Tufin SecureChange prior to R19.3 HF3 and R20-1 HF1 are vulnerable to stored XSS. The successful exploitation requires admin privileges (for storing the XSS payload itself), and can exploit (be triggered by) admin users. All TOS versions with SecureChange deployments prior to R19.3 HF3 and R20-1 HF1 are affected. Vulnerabilities were fixed in R19.3 HF3 and R20-1 HF1.

Affected products

• Tufin Securechange: before r19-3; r19-3, r20-1 — fixed in r19-3

How to fix

Upgrade to a fixed version: Tufin Securechange r19-3. Check the vendor advisory for mitigations.

References

• https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
• https://portal.tufin.com/aspx/SecurityAdvisories
• https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
• https://portal.tufin.com/aspx/SecurityAdvisories

Get alerted when CVE-2020-13134 or the next vulnerability affects your stack