PT-2020-2096 · Prosody · Prosody

Matthew Wild · Published 2020-01-28 · Updated 2020-02-04 · CVE-2020-8086

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Prosody mod auth ldap and mod auth ldap2 Community Modules versions prior to 2020-01-27

Description The issue is related to the incomplete verification of the XMPP address passed to the is admin() function in the mod auth ldap and mod auth ldap2 Community Modules for Prosody. This can allow a remote entity to gain admin-only functionality if their username matches that of a local admin, potentially leading to unauthorized access to confidential data, disruption of data integrity, and denial of service.

Recommendations For Prosody mod auth ldap and mod auth ldap2 Community Modules versions prior to 2020-01-27, update to a version released after 2020-01-27 to ensure proper verification of XMPP addresses and prevent unauthorized access. As a temporary workaround, consider restricting access to admin-only functionality until the update can be applied.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2020-01956

CVE-2020-8086

DSA-4612-1

Affected Products

Prosody

References · 16

• https://osv.dev/vulnerability/UBUNTU-CVE-2020-8086 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-8086 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8086 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-8086 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-8086 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01956 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-8086 · Security Note
• https://debian.org/security/2020/dsa-4612 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-8086 · Vendor Advisory
• https://prosody.im/security/advisory_20200128 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4612-1 · Vendor Advisory
• https://hg.prosody.im/prosody-modules/rev/f2b29183ef08 · Note
• https://seclists.org/bugtraq/2020/Feb/5 · Note
• https://t.me/cvenotify/542 · Telegram Post
• https://hg.prosody.im/prosody-modules/log/tip/mod_auth_ldap2/mod_auth_ldap2.lua · Note