CVE-2020-23361: Critical severity phplist vulnerability
Published Jan 27, 2021
·Updated
phpList 3.5.3 allows type juggling for login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters.
Affected Software
1 affected component
PHPlist PHPList=3.5.3
Event History
Jan 27, 2021
CVE Published
via MITRE·03:30 PM
Data Sourced
via MITRE·03:30 PM
Description
Frequently Asked Questions
1
What is CVE-2020-23361?
CVE-2020-23361 is a vulnerability in phpList version 3.5.3 that allows for login bypass through password hash mishandling.
2
How severe is CVE-2020-23361?
CVE-2020-23361 is classified as critical with a severity score of 9.8.
3
How does CVE-2020-23361 allow for login bypass?
CVE-2020-23361 allows for login bypass by using type juggling and mishandling password hashes that start with '0e' followed by only numerical characters.
4
Which version of phpList is affected by CVE-2020-23361?
phpList version 3.5.3 is affected by CVE-2020-23361.
5
Where can I find more information about CVE-2020-23361?
You can find more information about CVE-2020-23361 at the following link: https://github.com/phpList/phplist3/issues/668