CVE-2020-8902: google llc rendertron Improper Access Control
Vulnerability summary
CVE-2020-8902 is a medium (CVSS 4.3) Improper Access Control vulnerability in google llc rendertron. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 23.9% of scored vulnerabilities.
Timeline
- 23-02-2021PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
Rendertron versions prior to 3.0.0 are are susceptible to a Server-Side Request Forgery (SSRF) attack. An attacker can use a specially crafted webpage to force a rendertron headless chrome process to render internal sites it has access to, and display it as a screenshot. Suggested mitigations are to upgrade your rendertron to version 3.0.0, or, if you cannot update, to secure the infrastructure to limit the headless chrome's access to your internal domain.
CVSS metrics
3 scores · 2 sources · 2 versions- CVE.orgCNA3.5LowCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NDiffers
EPSS trend
Probability
0.33%
Chance of exploitation in the next 30 days
Percentile
24%
Versus all other CVEs
30-day change
0.00 pp
From 0.33% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
Affected systems
Google1 product
- rendertron< 3.0.0
Google llc1 product
- rendertron≥ stable, < 3.0.0
Npm1 product
- rendertron< 3.0.0
3 vendors · 3 products
