CVE-2020-29668

Katalog CVE

CVSS 3.7 · Low EPSS 2,0%

Kerentanan Improper Authentication pada sympa, fedoraproject fedora +1 lainnya. Skor CVSS 3.1 3.7 (Low) menurut NVD.

Deskripsi (NVD)

Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun.

Rincian

Terbit di NVD

10 Desember 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

3.7 (Low), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication
CWE-565: Reliance on Cookies without Validation and Integrity Checking

EPSS (30 hari)

2,0% peluang dieksploitasi; lebih tinggi dari 80,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/sympa-community/sympa/issues/1041 exploit · patch · advisory pihak ketiga
• https://github.com/sympa-community/sympa/pull/1044 patch · advisory pihak ketiga
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976020 mailing list · advisory pihak ketiga
• https://github.com/sympa-community/sympa/blob/6.2.59b.2/NEWS.md release notes · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2020/12/msg00026.html mailing list · advisory pihak ketiga
• https://www.debian.org/security/2020/dsa-4818 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EFZWDEKQFW3EH...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JICIHAJKKCZXJ...