CVE-2020-15136

Katalog CVE

CVSS 6.5 · Medium EPSS 1,6%

Kerentanan Improper Authentication pada redhat etcd, fedoraproject fedora. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.

Rincian

Terbit di NVD

6 Agustus 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication
CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 75,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/etcd-io/etcd/security/advisories/GHSA-wr2v-9rpq-c35q advisory pihak ketiga
• https://github.com/etcd-io/etcd/blob/master/Documentation/op-guide/gateway.md broken link
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DC...