CVE-2020-26276

Katalog CVE

CVSS 9.8 · Critical EPSS 2,2%

Kerentanan Authentication Bypass by Spoofing pada fleetdm fleet. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Fleet is an open source osquery manager. In Fleet before version 3.5.1, due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from a SAML IdP. Users that configure Fleet with SSO login may be vulnerable to this issue. This issue is patched in 3.5.1. The fix was made using https://github.com/mattermost/xml-roundtrip-validator If upgrade to 3.5.1 is not possible, users should disable SSO authentication in Fleet.

Rincian

Terbit di NVD

17 Desember 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-290: Authentication Bypass by Spoofing

EPSS (30 hari)

2,2% peluang dieksploitasi; lebih tinggi dari 82,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/fleetdm/fleet/commit/57812a532e5f749c8e18c6f6a652eca65c083607 patch · advisory pihak ketiga
• https://github.com/fleetdm/fleet/blob/master/CHANGELOG.md#fleet-351-dec-14-2020 release notes · advisory pihak ketiga
• https://github.com/fleetdm/fleet/security/advisories/GHSA-w3wf-cfx3-6gcx advisory pihak ketiga
• https://github.com/mattermost/xml-roundtrip-validator advisory pihak ketiga
• https://mattermost.com/blog/coordinated-disclosure-go-xml-vulnerabilities not applicable · advisory pihak ketiga