CVE-2020-8547: Critical severity PHPlist PHPList vulnerability
Published Feb 3, 2020
·Updated
phpList 3.5.0 allows type juggling for admin login bypass because == is used instead of === for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters.
Affected Software
1 affected component
PHPlist PHPList=3.5.0
Event History
Feb 3, 2020
CVE Published
via MITRE·03:52 PM
Data Sourced
via MITRE·03:52 PM
Description
Data Sourced
via NVD·04:15 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2020-8547?
CVE-2020-8547 has been assigned a medium severity rating due to its potential for unauthorized admin login bypass.
2
How do I fix CVE-2020-8547?
To fix CVE-2020-8547, update phpList to a version that uses strict comparison for password hashes.
3
What is the cause of CVE-2020-8547?
CVE-2020-8547 is caused by the use of type juggling due to the equality operator == being used instead of === for comparing password hashes.
4
Which version of phpList is affected by CVE-2020-8547?
CVE-2020-8547 specifically affects phpList version 3.5.0.
5
Can CVE-2020-8547 be exploited remotely?
Yes, CVE-2020-8547 can potentially be exploited remotely if an attacker can access the admin login interface.