CVE-2020-37094: EspoCRM 5.7.0 < 5.9.0 - Two-Factor Authentication Bypass via Auth Token Reuse Between Accounts with Identical Passwords
EspoCRM 5.7.0 prior to 5.9.0 contains an authentication token reuse vulnerability that allows authenticated attackers to bypass two-factor authentication by exploiting token-to-password-hash mapping in application/Espo/Core/Utils/Authentication/Espo.php. Attackers can obtain an authentication token for a controlled account and replay it against any victim account sharing the same password, since tokens are bound to password hashes rather than unique per-user values, bypassing the victim's 2FA protections.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2020-37094?
CVE-2020-37094 has a medium severity rating, indicating that it poses a significant security risk that could lead to unauthorized access.
How do I fix CVE-2020-37094?
To fix CVE-2020-37094, update to a patched version of EspoCRM that addresses the privilege escalation vulnerability.
What type of vulnerability is CVE-2020-37094?
CVE-2020-37094 is categorized as an authentication vulnerability that allows privilege escalation.
Who is affected by CVE-2020-37094?
CVE-2020-37094 affects users of EspoCRM version 5.8.5 due to its flawed handling of authorization headers.
Can CVE-2020-37094 be exploited remotely?
Yes, attackers can exploit CVE-2020-37094 remotely by manipulating authorization tokens to gain unauthorized access.