CVEvulnerability
CVE-2020-29668
3.7 LOW
Official page ↗
- Status
- Modified
- Published
- 2020-12-10
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 3.7 LOW — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-287, CWE-565
Description
Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun.
Affected configurations
• sympa sympa (<= 6.2.58)
• sympa sympa 6.2.59
• fedoraproject fedora 32
• fedoraproject fedora 33
• debian debian linux 9.0
• debian debian linux 10.0
Related
References
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976020 Mailing List, Third Party Advisory
- https://github.com/sympa-community/sympa/blob/6.2.59b.2/NEWS.md Release Notes, Third Party Advisory
- https://github.com/sympa-community/sympa/issues/1041 Exploit, Patch, Third Party Advisory
- https://github.com/sympa-community/sympa/pull/1044 Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/12/msg00026.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EFZWDEKQFW3EH665OECDWIWM2MI7T53Y/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JICIHAJKKCZXJNIICUDYXGZFQCN6J4U6/ lists.fedoraproject.org
- https://www.debian.org/security/2020/dsa-4818 Third Party Advisory
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976020 Mailing List, Third Party Advisory
- https://github.com/sympa-community/sympa/blob/6.2.59b.2/NEWS.md Release Notes, Third Party Advisory
- https://github.com/sympa-community/sympa/issues/1041 Exploit, Patch, Third Party Advisory
- https://github.com/sympa-community/sympa/pull/1044 Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/12/msg00026.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EFZWDEKQFW3EH665OECDWIWM2MI7T53Y/ lists.fedoraproject.org
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JICIHAJKKCZXJNIICUDYXGZFQCN6J4U6/ lists.fedoraproject.org
- https://www.debian.org/security/2020/dsa-4818 Third Party Advisory