CVE-2019-20933 PUBLISHED

InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).

EPSS 93.97% · 99.9th percentile

Risk Scores

EPSS Score
93.97%
99.9th percentile

Affected Products

VendorProductVersions
Ubuntu:18.04:LTSinfluxdb0, 1.1.1+dfsg1-4
Ubuntu:22.04:LTSinfluxdb0
Ubuntu:20.04:LTSinfluxdb0, 1.6.4-1build1

Timeline

References

Open in Interactive Console →