CVE-2020-8086

CRITICAL EPSS 72.2%
Published Jan 28, 20206y ago · Modified Jun 17, 20262w ago
9.8 CVSS 3.1
Critical
Find Similar
Published Jan 28, 2020 6y ago
Last Modified Jun 17, 2026 2w ago

Description

The mod_auth_ldap and mod_auth_ldap2 Community Modules through 2020-01-27 for Prosody incompletely verify the XMPP address passed to the is_admin() function. This grants remote entities admin-only functionality if their username matches the username of a local admin.

CVSS Details

Base Score
9.8
Exploitability
3.9
Impact
5.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
72.2% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-863 Incorrect Authorization Authorization

Affected Products 4

VendorProductVersionRange
prosodymod_auth_ldap* ≤2020-01-27
prosodymod_auth_ldap2* ≤2020-01-27
debiandebian_linux9.0any
debiandebian_linux10.0any

References 5

  • hg.prosody.im https://hg.prosody.im/prosody-modules/log/tip/mod_auth_ldap/mod_auth_ldap.lua
    Third Party Advisory
  • hg.prosody.im https://hg.prosody.im/prosody-modules/log/tip/mod_auth_ldap2/mod_auth_ldap2.lua
    Third Party Advisory
  • prosody.im https://prosody.im/security/advisory_20200128/
    Vendor Advisory
  • seclists.org https://seclists.org/bugtraq/2020/Feb/5
    Mailing ListThird Party Advisory
  • debian.org https://www.debian.org/security/2020/dsa-4612
    Third Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.