PT-2020-14585 · Goahead · Goahead Web Server

Published 2020-07-23 · Updated 2023-01-31 · CVE-2020-15688

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GoAhead web server versions prior to 5.1.2

Description The issue concerns the HTTP Digest Authentication in the GoAhead web server, which does not fully protect against replay attacks. This allows an unauthenticated remote attacker to bypass authentication through capture-replay if the communication channel is not protected by TLS.

Recommendations For versions prior to 5.1.2, update to version 5.1.2 or later to resolve the issue. As a temporary workaround, consider using TLS to protect the underlying communication channel and prevent replay attacks. Restrict access to sensitive areas of the web server to minimize the risk of exploitation until the update is applied.

Exploit

Fix

Weakness Enumeration

CWE-294

Related Identifiers

CVE-2020-15688

Affected Products

Goahead Web Server

References · 4

• 🔥 http://packetstormsecurity.com/files/159505/EmbedThis-GoAhead-Web-Server-5.1.1-Digest-Authentication-Capture-Replay-Nonce-Reuse.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-15688 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15688 · Vendor Advisory
• ❌ https://github.com/embedthis/goahead-gpl/issues/3 · Note, Deleted