CVE-2020-29668
Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any...
Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun.
- Record
CVE-2020-29668- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:P/I:N/A:N - Weakness
- CWE-287, CWE-565
- Updated
- 2026-11-02
CVE List No score
Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun.
- Record
CVE-2020-29668- Updated
- 2026-11-02
EUVDEUVD-2020-22025 No score
Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun.
- Record
EUVD-2020-22025- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wrwc-95g6-4fm3
Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any...
Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun.
- Record
GHSA-wrwc-95g6-4fm3- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-287
- Updated
- 2026-11-02
OSV
Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun.
- Record
CVE-2020-29668- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-29668
Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun.
- Record
DEBIAN-CVE-2020-29668- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-29668
Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun.
- Record
UBUNTU-CVE-2020-29668- CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sympaDebian:12 |
before 6.2.58~dfsg-2 | 6.2.58~dfsg-2 |
sympaDebian:13 |
before 6.2.58~dfsg-2 | 6.2.58~dfsg-2 |
sympaDebian:14 |
before 6.2.58~dfsg-2 | 6.2.58~dfsg-2 |
sympaDebian:9 |
before 6.2.16~dfsg-3+deb9u5, plus listed versions 6.2.16~dfsg-36.2.16~dfsg-3+deb9u16.2.16~dfsg-3+deb9u26.2.16~dfsg-3+deb9u36.2.16~dfsg-3+deb9u4 |
6.2.16~dfsg-3+deb9u5 |
sympaDebian:10 From an advisory covering 4 CVEs |
before 6.2.40~dfsg-1+deb10u1, plus listed versions 6.2.40~dfsg-1 |
6.2.40~dfsg-1+deb10u1 |
sympaUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 6.1.24~dfsg-16.1.24~dfsg-1ubuntu0.1~esm1 |
None known |
sympaUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 6.2.18~dfsg-16.2.22~dfsg-16.2.24~dfsg-16.2.24~dfsg-1ubuntu0.1~esm16.2.24~dfsg-1ubuntu0.1~esm2 |
None known |
sympaUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 6.2.40~dfsg-16.2.40~dfsg-36.2.40~dfsg-46.2.40~dfsg-4ubuntu0.20.04.1~esm16.2.40~dfsg-4ubuntu0.20.04.1~esm2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-29668 is a low vulnerability (CVSS 3.7) in Sympa, published December 10, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.98%, the 80th percentile. Fixed in sympa 6.2.58~dfsg-2.
References
github.com/sympa-community/sympa/issues/1041
bugs.debian.org/cgi-bin/bugreport.cgi?bug=976020
lists.debian.org/debian-lts-announce/2020/12/msg00026.html
debian.org/security/2020/dsa-4818
Show 9 moreShow less
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JICIHAJKKCZXJNIICUDYXGZFQCN6J4U6
nvd.nist.gov/vuln/detail/CVE-2020-29668
security-tracker.debian.org/tracker/CVE-2020-29668
ubuntu.com/security/CVE-2020-29668
cve.org/CVERecord?id=CVE-2020-29668