Security readout for executives and security teams
Plain-English summary
CVE-2020-35580 lets an unauthenticated remote user read files from vulnerable SearchBlox servers before version 9.2.2. The business risk is credential exposure: the reported files may include SearchBlox configuration data containing an admin API key and encoded password hashes.
Executive priority
Treat this as urgent for any exposed SearchBlox deployment because unauthenticated file reads can disclose administrative secrets. Prioritize version verification, upgrade, access restriction, and credential rotation.
Technical view
The issue is a local file inclusion in SearchBlox FileServlet affecting SearchBlox versions before 9.2.2. Sources state arbitrary operating-system file reads are possible, including SearchBlox configuration files that may expose the Super Admin API key and user password hashes.
Likely exposure
Organizations running SearchBlox before 9.2.2, especially internet-accessible deployments, are the likely exposure group. The source bundle does not provide CPEs, package identifiers, or deployment prevalence.
Exploitation context
The CVE source describes remote unauthenticated file read. A public write-up is cited, but the bundle does not include KEV status or another cited source confirming active exploitation in the wild.
Researcher notes
CVE metadata lacks CVSS, CWE, CPE, and detailed vendor remediation notes in the supplied bundle. The core impact is still clear: unauthenticated LFI against FileServlet with potential disclosure of sensitive SearchBlox configuration secrets.
Mitigation direction
- Upgrade SearchBlox to version 9.2.2 or later.
- Check current SearchBlox vendor guidance for supported fixed versions.
- Restrict external access to SearchBlox management and servlet paths.
- Rotate exposed SearchBlox API keys and affected user credentials.
- Review logs for suspicious FileServlet access patterns.
Validation and detection
- Inventory all SearchBlox instances and record their versions.
- Confirm no production instance runs a version before 9.2.2.
- Verify SearchBlox is not unnecessarily exposed to the internet.
- Review application logs for unexpected FileServlet requests.
- Confirm admin API keys and user passwords were rotated after suspected exposure.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Credential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2020-35580 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://developer.searchblox.com/docs/getting-started-with-searchbloxCVE reference · x_refsource_MISC
- https://hateshape.github.io/general/2021/05/11/CVE-2020-35580.htmlCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.