CVE-2020-26542
First published: Mon Nov 09 2020(Updated: )
An issue was discovered in the MongoDB Simple LDAP plugin through 2020-10-02 for Percona Server when using the SimpleLDAP authentication in conjunction with Microsoft’s Active Directory, Percona has discovered a flaw that would allow authentication to complete when passing a blank value for the account password, leading to access against the service integrated with which Active Directory is deployed at the level granted to the authenticating account.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Percona Percona Server | <=2020-10-02 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://jira.percona.com/browse/PS-7358
- https://jira.percona.com/browse/PSMDB-726
- https://www.percona.com/blog/2020/10/13/percona-distribution-for-mysql-pxc-variant-8-0-20-fixes-for-security-vulnerability-release-roundup-october-13-2020/
- https://www.percona.com/doc/percona-distribution-mysql/8.0/release-notes-pxc-v8.0.20.upd2.html
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2020-26542.
What is the severity of CVE-2020-26542?
CVE-2020-26542 has a severity score of 9.8 (Critical).
What is the affected software for CVE-2020-26542?
The affected software for CVE-2020-26542 is Percona Server.
How does the vulnerability impact Percona Server?
The vulnerability allows authentication to complete when passing a blank value for the account, which can lead to unauthorized access.
Are there any available fixes for CVE-2020-26542?
Yes, Percona has released fixes for CVE-2020-26542. It is advised to update to the latest version of Percona Server.
- collector/nvd-index
- agent/weakness
- agent/type
- agent/severity
- agent/references
- agent/author
- agent/tags
- agent/event
- agent/description
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/percona
- canonical/percona percona server
- version/percona percona server/2020-10-02