CVE-2020-4042 - CVE House
Back to Database
Status published Medium CVE-2020-4042

Authentication bypass in Bareos

Vulnerability Description

Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to the director itself leading to the director responding to the replayed challenge. The response obtained is then a valid reply to the directors original challenge. This is fixed in version 19.2.8.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-4042

Credits & Attribution

No credits recorded in the NVD database.

References

More from bareos

View All →
CVE-2024-45044
Bareos's negative command ACLs can be circumvented by abbreviating commands
High 8.8
CVE-2022-24756
Missing Release of Memory after Effective Lifetime in Bareos Director
High 7.5
CVE-2022-24755
Incorrect Authorization in Bareos Director
High 8.1
CVE-2017-14610
bareos-dir, bareos-fd, and bareos-sd in bareos-core in Bareos 16.2.6 and...
High 7.8

Affected Vendor

Affected Software

bareos
Vulnerable Versions:
< 19.2.8

Timeline

Official Publish: July 10th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Weaknesses (CWE)

CWE-294

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.