CVEvulnerability
CVE-2020-15688
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-07-23
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-294
Description
The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attacks. This allows an unauthenticated remote attacker to bypass authentication via capture-replay if TLS is not used to protect the underlying communication channel.
Affected configurations
• embedthis goahead (< 5.1.2)
Related
Weakness · CWE (1)
- CWE-294 Authentication Bypass by Capture-replay weakness
References
- http://packetstormsecurity.com/files/159505/EmbedThis-GoAhead-Web-Server-5.1.1-Digest-Authentication-Capture-Replay-Nonce-Reuse.html Exploit, Third Party Advisory, VDB Entry
- https://github.com/embedthis/goahead-gpl/issues/3 Third Party Advisory
- https://github.com/embedthis/goahead-gpl/issues/3 Third Party Advisory
- https://github.com/embedthis/goahead-gpl/issues/3 Third Party Advisory
- https://github.com/embedthis/goahead-gpl/issues/3 Third Party Advisory
- http://packetstormsecurity.com/files/159505/EmbedThis-GoAhead-Web-Server-5.1.1-Digest-Authentication-Capture-Replay-Nonce-Reuse.html Exploit, Third Party Advisory, VDB Entry
- https://github.com/embedthis/goahead-gpl/issues/3 Third Party Advisory
- https://github.com/embedthis/goahead-gpl/issues/3 Third Party Advisory
- https://github.com/embedthis/goahead-gpl/issues/3 Third Party Advisory
- https://github.com/embedthis/goahead-gpl/issues/3 Third Party Advisory