CVE-2020-29668

Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun.

References

Affected packages

Git / github.com/sympa-community/sympa

Affected ranges

Type: GIT
Repo: https://github.com/sympa-community/sympa
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Last affected

90b6c3918052f0b797d6b8ae1b0e60445d29a97c

Affected versions

6.*

6.2.16

6.2.17b.1

6.2.17b.2

6.2.18

6.2.19b.1

6.2.19b.2

6.2.20

6.2.22

6.2.23b.1

6.2.23b.2

6.2.23b.3

6.2.24

6.2.25b.1

6.2.25b.2

6.2.25b.3

6.2.26

6.2.28

6.2.30

6.2.32

6.2.33b.1

6.2.33b.2

6.2.34

6.2.35b.1

6.2.36

6.2.37b.1

6.2.37b.2

6.2.37b.3

6.2.38

6.2.40

6.2.41b.1

6.2.41b.2

6.2.42

6.2.43b.1

6.2.43b.2

6.2.44

6.2.45b.1

6.2.45b.2

6.2.45b.3

6.2.46

6.2.48

6.2.49b.1

6.2.49b.2

6.2.49b.3

6.2.50

6.2.52

6.2.54

6.2.56

6.2.57b.1

6.2.57b.2

6.2.58

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-29668.json"