Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-29668

Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun.

Published

2020-12-10T08:15:11.410

Last Modified

2024-11-21T05:24:24.243

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 3.7 (LOW)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: NONE
Confidentiality Impact: PARTIAL
Integrity Impact: NONE
Availability Impact: NONE

Exploitability Score

8.6

Impact Score

2.9

Weaknesses

Type: Primary
CWE-287
CWE-565

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	sympa	sympa	≤ 6.2.58	Yes
Application	sympa	sympa	6.2.59	Yes
Operating System	fedoraproject	fedora	32	Yes
Operating System	fedoraproject	fedora	33	Yes
Operating System	debian	debian_linux	9.0	Yes
Operating System	debian	debian_linux	10.0	Yes

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976020 Mailing List, Third Party Advisory ([email protected])
https://github.com/sympa-community/sympa/blob/6.2.59b.2/NEWS.md Release Notes, Third Party Advisory ([email protected])
https://github.com/sympa-community/sympa/issues/1041 Exploit, Patch, Third Party Advisory ([email protected])
https://github.com/sympa-community/sympa/pull/1044 Patch, Third Party Advisory ([email protected])
https://lists.debian.org/debian-lts-announce/2020/12/msg00026.html Mailing List, Third Party Advisory ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EFZWDEKQFW3EH665OECDWIWM2MI7T53Y/ ([email protected])
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JICIHAJKKCZXJNIICUDYXGZFQCN6J4U6/ ([email protected])
https://www.debian.org/security/2020/dsa-4818 Third Party Advisory ([email protected])
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976020 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/sympa-community/sympa/blob/6.2.59b.2/NEWS.md Release Notes, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/sympa-community/sympa/issues/1041 Exploit, Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://github.com/sympa-community/sympa/pull/1044 Patch, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://lists.debian.org/debian-lts-announce/2020/12/msg00026.html Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EFZWDEKQFW3EH665OECDWIWM2MI7T53Y/ (af854a3a-2127-422b-91ae-364da2661108)
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JICIHAJKKCZXJNIICUDYXGZFQCN6J4U6/ (af854a3a-2127-422b-91ae-364da2661108)
https://www.debian.org/security/2020/dsa-4818 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)