CVE-2020-11020

Authentication and extension bypass in Faye

State: Published
Severity: 8.5 High
Published: Apr 29, 2020
Updated: Aug 4, 2024
Reserved: Mar 30, 2020

Description

Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1.0.4, 1.1.3 and 1.2.5, has the potential for authentication bypass in the extension system. The vulnerability allows any client to bypass checks put in place by server-side extensions, by appending extra segments to the message channel. It is patched in versions 1.0.4, 1.1.3 and 1.2.5.

Scores

CVSS	Score	Vector	Source
3.1	8.5 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N	GitHub_M

Weaknesses

CWE-287 Improper Authentication

Affected Products

Product	Versions
Fayefaye	>= 0.5.0, < 1.0.4Affected >= 1.1.0, < 1.1.3Affected >= 1.2.0, < 1.2.5Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.