PT-2020-16344 · Alerta · Alerta

Published 2020-11-06 · Updated 2020-11-17 · CVE-2020-26214

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Alerta versions prior to 8.1.0

Description The issue allows users to bypass LDAP authentication by providing an empty password when the Alerta server is configured to use LDAP as the authorization provider. This affects deployments where LDAP servers are configured to allow unauthenticated authentication mechanisms for anonymous authorization. A fix has been implemented that returns an HTTP 401 Unauthorized response for any authentication attempts where the password field is empty.

Recommendations For versions prior to 8.1.0, update to version 8.1.0 to resolve the issue. As a temporary workaround, LDAP administrators can disallow unauthenticated bind requests by clients.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-26214

GHSA-5HMM-X8Q8-W5JH

PYSEC-2020-159

Affected Products

Alerta

References · 13

• https://github.com/alerta/alerta/commit/2bfa31779a4c9df2fa68fa4d0c5c909698c5ef65 · Patch
• https://osv.dev/vulnerability/CVE-2020-26214 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26214 · Security Note
• https://osv.dev/vulnerability/PYSEC-2020-159 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5hmm-x8q8-w5jh · Vendor Advisory
• https://github.com/alerta/alerta · Note
• https://github.com/alerta/alerta/security/advisories/GHSA-5hmm-x8q8-w5jh · Note
• https://github.com/alerta/alerta/pull/1345 · Note
• https://github.com/alerta/alerta/issues/1277 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/alerta-server/PYSEC-2020-159.yaml · Note
• https://pypi.org/project/alerta-server/8.1.0 · Note
• https://tools.ietf.org/html/rfc4513#section-5.1.2 · Note
• https://t.me/cibsecurity/15986 · Telegram Post