How severe is CVE-2020-9300?

CVE-2020-9300 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2020-9300 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (56th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-9300?

CVE-2020-9300 affects Netflix Dispatch. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2020-9300?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2020-9300 published?

CVE-2020-9300 was published on 2020-11-09 and last updated on 2026-06-17.

CVE-2020-9300

CVE-2020-9300 is a medium-severity vulnerability in Netflix Dispatch with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v2: 4.0
EPSS exploit prediction: 1% (56th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Netflix Dispatch
Published: 2020-11-09
Last modified: 2026-06-17

Description

The Access Control issues include allowing a regular user to view a restricted incident, user role escalation to admin, users adding themselves as a participant in a restricted incident, and users able to view restricted incidents via the search feature. If your install has followed the secure deployment guidelines the risk of this is lowered, as this may only be exploited by an authenticated user.

Frequently asked questions

What is CVE-2020-9300?: The Access Control issues include allowing a regular user to view a restricted incident, user role escalation to admin, users adding themselves as a participant in a restricted incident, and users able to view restricted incidents via the search feature. If your install has followed the secure deployment guidelines the risk of this is lowered, as this may only be exploited by an authenticated user.
How severe is CVE-2020-9300?: CVE-2020-9300 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2020-9300 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (56th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-9300?: CVE-2020-9300 affects Netflix Dispatch. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2020-9300?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2020-9300 published?: CVE-2020-9300 was published on 2020-11-09 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:netflix:dispatch:*:*:*:*:*:*:*:*

More vulnerabilities in Netflix Dispatch

CVE-2023-40171 — Critical (CVSS 9.1): Dispatch is an open source security incident management tool. The server response includes the JWT Secret Key used for…
CVE-2020-9299 — Medium (CVSS 5.4): There were XSS vulnerabilities discovered and reported in the Dispatch application, affecting name and description…

All CVEs affecting Netflix Dispatch →