CVE-2020-26276

CRITICAL Year: 2020
CVSS v3 Score
9.8
Critical
CVSS v2 Score
6.8
Medium
Weakness Type
CWE-290
View all →

Vulnerability Description

Fleet is an open source osquery manager. In Fleet before version 3.5.1, due to issues in Go's standard library XML parsing, a valid SAML response may be mutated by an attacker to modify the trusted document. This can result in allowing unverified logins from a SAML IdP. Users that configure Fleet with SSO login may be vulnerable to this issue. This issue is patched in 3.5.1. The fix was made using https://github.com/mattermost/xml-roundtrip-validator If upgrade to 3.5.1 is not possible, users should disable SSO authentication in Fleet.

Related Vulnerabilities

CVE-2009-1048

CRITICAL
CVSS:9.8(Critical)

The web interface on the snom VoIP phones snom 300, snom 320, snom 360, snom 370, and snom 820 with firmware 6.5 before 6.5.20, 7.1 before 7.1.39, and 7.3 before 7.3.14 allows remote attackers to bypa...

CWE-2902009

CVE-2017-14003

CRITICAL
CVSS:9.8(Critical)

An Authentication Bypass by Spoofing issue was discovered in LAVA Ether-Serial Link (ESL) running firmware versions 6.01.00/29.03.2007 and prior versions. An improper authentication vulnerability has ...

CWE-2902017

CVE-2017-14375

CRITICAL
CVSS:9.8(Critical)

EMC Unisphere for VMAX Virtual Appliance (vApp) versions prior to 8.4.0.15, EMC Solutions Enabler Virtual Appliance versions prior to 8.4.0.15, EMC VASA Virtual Appliance versions prior to 8.4.0.512, ...

CWE-2902017

CVE-2018-15715

CRITICAL
CVSS:9.8(Critical)

Zoom clients on Windows (before version 4.1.34814.1119), Mac OS (before version 4.1.34801.1116), and Linux (2.4.129780.0915 and below) are vulnerable to unauthorized message processing. A remote unaut...

CWE-2902018

CVE-2018-5353

CRITICAL
CVSS:9.8(Critical)

The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing. It does not authenticate the inten...

CWE-2902018

CVE-2018-7842

CRITICAL
CVSS:9.8(Critical)

A CWE-290: Authentication Bypass by Spoofing vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause an elevation of privilege by...

CWE-2902018