Unrated

Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as t...

CVE-2020-29668 First seen on SecPulse Dec 10, 2020

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2020-29668 sympa Fixed in: 6.2.58~dfsg-2
Ubuntu UBUNTU-CVE-2020-29668 sympa

Original description The description as published by the source.

Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

References

advisory bugs.debian.org
advisory github.com
advisory lists.debian.org
advisory debian.org
patch github.com
patch github.com
web lists.fedoraproject.org
web lists.fedoraproject.org

Key facts

Severity: Unrated
Published: Dec 10, 2020
First seen on SecPulse: Dec 10, 2020

NVD OSV

Detection sources

OSV.dev (Open Source Vulnerabilities)Oct 20, 19:54