CVE-2020-10807

2020-03-2216:15:12

Google

osv.dev

7.1 High

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

58.7%

JSON

auth_svc in Caldera before 2.6.5 allows authentication bypass (for REST API requests) via a forged “localhost” string in the HTTP Host header.

CPENameOperatorVersion
calderaeq2.6.1
calderaeq2.6.0
calderaeq2.6.4
calderaeq2.1.0
calderaeq2.3.1
calderaeq2.6.2
calderaeq2.0.0
calderaeq2.6.3
calderaeq2.3.0

Name	Operator	Version
caldera	eq	2.6.1
caldera	eq	2.6.0
caldera	eq	2.6.4
caldera	eq	2.1.0
caldera	eq	2.3.1
caldera	eq	2.6.2
caldera	eq	2.0.0
caldera	eq	2.6.3
caldera	eq	2.3.0

References

github.com/mitre/caldera/compare/2.6.4...2.6.5

github.com/mitre/caldera/issues/1405

github.com/mitre/caldera/pull/1407

github.com/mitre/caldera/releases/tag/2.6.5