CVE-2020-11020CWE-287

Authentication and extension bypass in Faye

High · published April 29, 2020

CVSS v3.1
8.5
EPSS
2%
Percentile
75.2
In the wild
Unconfirmed
What it is

Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1.0.4, 1.1.3 and 1.2.5, has the potential for authentication bypass in the extension system. The vulnerability allows any client to bypass checks put in place by server-side extensions, by appending extra segments to the message channel. It is patched in versions 1.0.4, 1.1.3 and 1.2.5.

The record
Technical detail
CVSS v3.1
8.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01573 · 75.2th percentile
Weakness
CWE-287 · Improper Authentication
Published
2020-04-29T17:35Z
EPSS history
Timeline
  • 29 APR 17:35Z
    Authentication and extension bypass in Faye
    cvelistv5