What’s Vulnerable › Vulnerabilities

CVE-2020-4042: Authentication bypass in Bareos

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-07-10 · updated 2026-06-17
• Weakness: CWE-294

Description

Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to the director itself leading to the director responding to the replayed challenge. The response obtained is then a valid reply to the directors original challenge. This is fixed in version 19.2.8.

Affected products

• bareos: through 19.2.7; 19.2.8-pre

References

• https://bugs.bareos.org/view.php?id=1250
• https://github.com/bareos/bareos/security/advisories/GHSA-vqpj-2vhj-h752
• https://bugs.bareos.org/view.php?id=1250
• https://github.com/bareos/bareos/security/advisories/GHSA-vqpj-2vhj-h752

Get alerted when CVE-2020-4042 or the next vulnerability affects your stack