by Kastro
Paper/Archive/CVE-2020-36569

CVE-2020-36569

github.com/nanobox-io/golang-nanoauth github.com/nanobox-io/golang-nanoauth — Authentication bypass in github.com/nanobox-io/golang-nanoauth

EPSS 0.9%CVSS 9.1
critical.is priorityof 100
39
CVSS 9.1 (ADP, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 59.1.591 × 2011.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896 if ListenAndServe is called with an empty token.

Affected

ProductAffectedFixed inSource
github.com/nanobox-io/golang-nanoauth0.0.0-20160722212129-ac0cc4484ad4 – < 0.0.0-20200131131040-063a3fb698960.0.0-20200131131040-063a3fb69896CNA

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/nanobox-io/golang-nanoauth/pull/5refgithub.com/nanobox-io/golang-nanoauth/commit/063a3fb69896acf985759f0fe3851f15973993f3refpkg.go.dev/vuln/GO-2020-0004