CVE-2020-29668

3.7 lowEPSS 2.0%

Low (3.7). EPSS 2.0% chance of exploitation in the next 30 days.

Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun.

Severity

CVSS 3.1

3.7 low

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 2.0% chance of exploitation in the next 30 days; higher than 80% of CVEs (scores of 2026-10-31)
CWEs: CWE-287, CWE-565
Published: 2020-12-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

debian:debian_linux
fedoraproject:fedora
sympa:sympa

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=976020
https://github.com/sympa-community/sympa/blob/6.2.59b.2/NEWS.md
https://github.com/sympa-community/sympa/issues/1041
https://github.com/sympa-community/sympa/pull/1044
https://lists.debian.org/debian-lts-announce/2020/12/msg00026.html

Check your stack JSON