Search for vulnerabilities
Vulnerability details: VCID-qhj3-hekm-nkdx
Vulnerability ID VCID-qhj3-hekm-nkdx
Aliases CVE-2020-15260
Summary PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In version 2.10 and earlier, PJSIP transport can be reused if they have the same IP address + port + protocol. However, this is insufficient for secure transport since it lacks remote hostname authentication. Suppose we have created a TLS connection to `sip.foo.com`, which has an IP address `100.1.1.1`. If we want to create a TLS connection to another hostname, say `sip.bar.com`, which has the same IP address, then it will reuse that existing connection, even though `100.1.1.1` does not have certificate to authenticate as `sip.bar.com`. The vulnerability allows for an insecure interaction without user awareness. It affects users who need access to connections to different destinations that translate to the same address, and allows man-in-the-middle attack if attacker can route a connection to another destination such as in the case of DNS spoofing.
Status Published
Exploitability 0.5
Weighted Severity 6.1
Risk 3.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-295 Improper Certificate Validation
System Score Found at
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2020-15260
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2020-15260
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2020-15260
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2020-15260
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2020-15260
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2020-15260
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2020-15260
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2020-15260
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2020-15260
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2020-15260
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2020-15260
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2020-15260
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2020-15260
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2020-15260
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2020-15260
epss 0.00185 https://api.first.org/data/v1/epss?cve=CVE-2020-15260
cvssv2 4.3 https://nvd.nist.gov/vuln/detail/CVE-2020-15260
cvssv3.1 6.8 https://nvd.nist.gov/vuln/detail/CVE-2020-15260
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2020-15260
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15260
https://github.com/pjsip/pjproject/commit/67e46c1ac45ad784db5b9080f5ed8b133c122872
https://github.com/pjsip/pjproject/pull/2663
https://github.com/pjsip/pjproject/security/advisories/GHSA-8hcp-hm38-mfph
https://security.gentoo.org/glsa/202107-42
986815 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=986815
cpe:2.3:a:teluu:pjsip:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:teluu:pjsip:*:*:*:*:*:*:*:*
CVE-2020-15260 https://nvd.nist.gov/vuln/detail/CVE-2020-15260
No exploits are available.
Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2020-15260
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2020-15260
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.40695
EPSS Score 0.00185
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:32:44.306638+00:00 Alpine Linux Importer Import https://secdb.alpinelinux.org/v3.15/main.json 37.0.0