← Back

CVE-2020-11020

nvd nist
Published: Apr 29, 2020Modified: Jun 17, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1.0.4, 1.1.3 and 1.2.5, has the potential for authentication bypass in the extension system. The vulnerability allows any client to bypass checks put in place by server-side extensions, by appending extra segments to the message channel. It is patched in versions 1.0.4, 1.1.3 and 1.2.5.

Affected (6)

Products: Faye Project: Faye
Faye Project
1 product
Faye
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Faye Project
Faye
After 0.5.0 to 1.0.4
Faye
From 1.1.0 to 1.1.3
Faye
From 1.2.0 to 1.2.5
Faye
After 0.5.0 to 1.0.4
Faye
From 1.1.0 to 1.1.3
Faye
From 1.2.0 to 1.2.5

Related CWEs

CWE-287
Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (4)

Source: security-advisories@github.com
PatchThird Party Advisory
Source: security-advisories@github.com
ExploitMitigationThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitMitigationThird Party Advisory

Timeline

No history available yet.