GitHub Advisoryadvisory · Go

GHSA-2rmp-fw5r-j5qv Improper Authentication in InfluxDB

CRITICAL Published 2021-05-18 Modified 2023-10-02 Official page ↗
Aliases
CVE-2019-20933
Ecosystem
Go
Packages
github.com/influxdata/influxdb
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287
Reviewed
2021-05-12

Affected packages

• Go github.com/influxdata/influxdb: < 1.7.6 → fixed in 1.7.6

Description

InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in `services/httpd/handler.go` because a JWT token may have an empty SharedSecret (aka shared secret).

Related

Alias · CVE (1)

  • CVE-2019-20933 InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT… vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References