CVE-2020-5849highunder attackCWE-697

CVE-2020-5849

Published · Updated

Follow this CVE+ Monitor Unraid

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.5epss 93%
from disclosure to weapon35 days
Published on NVDMar 16
1st PoC+35d
metasploitFeb 10
CISA KEV+597d
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

Unraid version 6.8.0 has a flaw that allows someone to bypass the authentication system and gain unauthorized access to the system without needing valid credentials.

Technical detail

CVE-2020-5849 affects Unraid 6.8.0 with an authentication bypass vulnerability (CWE-697: Incorrect Comparison). The vulnerability permits attackers to circumvent authentication mechanisms and gain unauthorized access to the system. Successful exploitation requires network access to the affected Unraid instance and results in complete compromise of system access controls.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Unraid 6.8.0 allows authentication bypass.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.