CVE-2020-8086
Critical
Description
The mod_auth_ldap and mod_auth_ldap2 Community Modules through 2020-01-27 for Prosody incompletely verify the XMPP address passed to the is_admin() function. This grants remote entities admin-only functionality if their username matches the username of a local admin.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Prosody Mod Auth Ldap
PublishedJan 28, 2020
First seenJan 28, 2020
How to fix
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| prosody mod_auth_ldap | v ≤ 2020-01-27 | — |
| prosody mod_auth_ldap2 | v ≤ 2020-01-27 | — |
| debian debian_linux | 9.0, 10.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.