CVE - CVE-2020-26214

CVE-ID
CVE-2020-26214	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider. Only deployments where LDAP servers are configured to allow unauthenticated authentication mechanism for anonymous authorization are affected. A fix has been implemented in version 8.1.0 that returns HTTP 401 Unauthorized response for any authentication attempts where the password field is empty. As a workaround LDAP administrators can disallow unauthenticated bind requests by clients.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://github.com/alerta/alerta/security/advisories/GHSA-5hmm-x8q8-w5jh URL:https://github.com/alerta/alerta/security/advisories/GHSA-5hmm-x8q8-w5jh MISC:https://github.com/alerta/alerta/commit/2bfa31779a4c9df2fa68fa4d0c5c909698c5ef65 URL:https://github.com/alerta/alerta/commit/2bfa31779a4c9df2fa68fa4d0c5c909698c5ef65 MISC:https://github.com/alerta/alerta/issues/1277 URL:https://github.com/alerta/alerta/issues/1277 MISC:https://github.com/alerta/alerta/pull/1345 URL:https://github.com/alerta/alerta/pull/1345 MISC:https://pypi.org/project/alerta-server/8.1.0/ URL:https://pypi.org/project/alerta-server/8.1.0/ MISC:https://tools.ietf.org/html/rfc4513#section-5.1.2 URL:https://tools.ietf.org/html/rfc4513#section-5.1.2
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20201001	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20201001)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)