CVE-2020-26214Critical· 9.1▾ AbyssalPoC availableLDAP authentication bypass with empty password
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 50.1 · likelihood 13.2 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
66%
Nuclei ×1
Users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider.
Only deployments where LDAP servers are configured to allow unauthenticated binds (eg. default on Active Directory) are affected.
A fix has been implemented that returns HTTP 401 Unauthorized response for any authentication attempts where the password field is empty. See https://github.com/alerta/alerta/pull/1345
LDAP administrators can disallow unauthenticated bind requests by clients.
https://tools.ietf.org/html/rfc4513#section-5.1.2 https://pypi.org/project/alerta-server/8.1.0/
If you have any questions or comments about this advisory:
alerta-server >= 8.0.0, < 8.1.0alerta-server < 7.5.7Upgrade to a patched release:
alerta-server 8.1.0alerta-server 7.5.7Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.