Critical severity · published Apr 29, 2020
CVE-2020-11020
Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1.0.4, 1.1.3 and 1.2.5, has the potential for authentication bypass in the extension system
9.8
CVSS
1.6%
EPSS
No
On KEV
Description
Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1.0.4, 1.1.3 and 1.2.5, has the potential for authentication bypass in the extension system. The vulnerability allows any client to bypass checks put in place by server-side extensions, by appending extra segments to the message channel. It is patched in versions 1.0.4, 1.1.3 and 1.2.5.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FA
Faye · Faye Project
after 0.5.0 before 1.0.4; after 0.5.0 before 1.0.4; 1.1.0 before 1.1.3; 1.1.0 before 1.1.3; 1.2.0 before 1.2.5; 1.2.0 before 1.2.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-11020
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-11020
Patch
https://github.com/faye/faye/commit/65d297d341b607f3cb0b5fa6021a625a991cc30e
Exploit
https://github.com/faye/faye/security/advisories/GHSA-qpg4-4w7w-2mq5
More from Faye
8.7
CVE-2020-15134
Faye before version 1.4.0, there is a lack of certification validation in TLS handshakes