CVE-2020-13382: openSIS missing authentication for critical function

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

critical priorityCVSS 9.1 with network reachability, no authentication, no user interaction, and public exploit code including unauthenticated code execution.

What it is

openSIS through 7.4 contains an incorrect access control flaw mapped to CWE-306, missing authentication for a critical function. Because the affected function is reachable without credentials, an unauthenticated remote attacker can invoke it directly. The record does not specify which endpoint or function is affected, only that access control is incorrect.

Impact

An attacker gains unauthenticated access to a critical function, with CVSS 3.1 scoring confidentiality and integrity as high and availability as none. Public exploit write-ups reference unauthenticated PHP code execution, so the practical outcome can extend to code execution on the server.

Attack surface

The vector is network-reachable with no privileges and no user interaction (AV:N/AC:L/PR:N/UI:N), so the vulnerable function is exposed directly over HTTP. No authentication is required per the CWE-306 classification.

Exploitation

Not listed in CISA KEV, but EPSS is 0.52814 (98.9th percentile) and multiple references are tagged Exploit, including a Packet Storm write-up for unauthenticated PHP code execution. Public exploit material exists, so exploitation is feasible for anyone who can reach the instance.

What to do

• Upgrade openSIS past 7.4 to a release containing the access control fix; the record does not name a fixed version, so confirm with the vendor commit history.
• If upgrade is not immediately possible, restrict network access to the openSIS instance to trusted networks or place it behind an authenticating reverse proxy.
• Review the vendor commit history referenced in the advisory to identify the affected function and apply the specific code change.
• Audit the application for other endpoints that perform critical actions without an authentication check.
• Monitor the instance for unexpected requests to administrative or file-handling endpoints.

Detection

• Review web server logs for unauthenticated requests to openSIS endpoints that should require a session, especially POSTs to admin or file-handling paths.
• Alert on requests returning HTTP 200 for actions normally gated behind login, and on anomalous PHP file creation or modification in the web root.
• Hunt for outbound connections or child processes spawned by the web server user that indicate code execution.
• Correlate Packet Storm exploit signatures or known payload patterns against inbound HTTP traffic to the openSIS path.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.