CVE-2019-20933

Katalog CVE

CVSS 9.8 · Critical EPSS 30,9%

Kerentanan Improper Authentication pada influxdata influxdb, debian linux. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).

Rincian

Terbit di NVD

19 November 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication

EPSS (30 hari)

30,9% peluang dieksploitasi; lebih tinggi dari 98,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/influxdata/influxdb/commit/761b557315ff9c1642cf3b0e5797cd3d983a24c0 patch · advisory pihak ketiga
• https://github.com/influxdata/influxdb/compare/v1.7.5...v1.7.6 patch · advisory pihak ketiga
• https://github.com/influxdata/influxdb/issues/12927 issue tracking · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2020/12/msg00030.html mailing list · advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-4823 advisory pihak ketiga