CVE Vulnerability

CVE-2020-26214

In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider. Only deployments where LDAP servers are configured to allow unauthenticated authentication mechanism for anonymous authorization are affected. A fix has been implemented in version 8.1.0 that returns HTTP 401 Unauthorized response for any authentication attempts where the password field is empty. As a workaround LDAP administrators can disallow unauthenticated bind requests by clients.

7.5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/alerta/alerta/issues/1277 Third Party Advisory
https://pypi.org/project/alerta-server/8.1.0/ Third Party Advisory
https://github.com/alerta/alerta/security/advisories/GHSA-5hmm-x8q8-w5jh Third Party Advisory
https://github.com/alerta/alerta/commit/2bfa31779a4c9df2fa68fa4d0c5c909698c5ef65 Patch Third Party Advisory
https://tools.ietf.org/html/rfc4513#section-5.1.2 Third Party Advisory
https://github.com/alerta/alerta/pull/1345 Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:alerta_project:alerta:*:*:*:*:*:*:*:*
cpe:2.3:a:alerta_project:alerta:*:*:*:*:*:*:*:*
Information

Published : 2020-11-06 06:15

Updated : 2020-11-17 09:08

NVD link : CVE-2020-26214

Mitre link : CVE-2020-26214

Products Affected
No products.
CWE
CWE-287