CVE-2020-29668

Description

Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun.

Risk Information

Base Score

3.7

MODERATE

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Score

Exploitation Probability

1.039

Associated Vulnerability

Vulnerability	OS Platform
sympa security update(DSA-4818-1) sympa_6.2.40~dfsg-1+deb10u1_i386.deb	Linux
sympa security update(DSA-4818-1) sympa_6.2.40~dfsg-1+deb10u1_amd64.deb	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234