What’s Vulnerable › Vulnerabilities

CVE-2020-29668

• Severity: low (CVSS 3.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-12-10 · updated 2026-06-17
• Weakness: CWE-287

Description

Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun.

Affected products

• Debian Linux: 9.0, 10.0
• Fedoraproject Fedora: 32, 33
• Sympa: through 6.2.58; 6.2.59-beta1

References

• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976020
• https://github.com/sympa-community/sympa/blob/6.2.59b.2/NEWS.md
• https://github.com/sympa-community/sympa/issues/1041
• https://github.com/sympa-community/sympa/pull/1044
• https://lists.debian.org/debian-lts-announce/2020/12/msg00026.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EFZWDEKQFW3EH665OECDWIWM2MI7T53Y/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JICIHAJKKCZXJNIICUDYXGZFQCN6J4U6/
• https://www.debian.org/security/2020/dsa-4818
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976020
• https://github.com/sympa-community/sympa/blob/6.2.59b.2/NEWS.md
• https://github.com/sympa-community/sympa/issues/1041
• https://github.com/sympa-community/sympa/pull/1044

Get alerted when CVE-2020-29668 or the next vulnerability affects your stack