CVE-2020-26542 | Vulnetix

CVE-2020-26542 PUBLISHED

Reported by mitre · Published November 9, 2020

An issue was discovered in the MongoDB Simple LDAP plugin through 2020-10-02 for Percona Server when using the SimpleLDAP authentication in conjunction with Microsoft’s Active Directory, Percona has discovered a flaw that would allow authentication to complete when passing a blank value for the account password, leading to access against the service integrated with which Active Directory is deployed at the level granted to the authenticating account.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
percona_server	percona	2020-10-02

Affected products

Vendor	Product	Versions
n/a	n/a	n/a
chainguard	percona-server-8.4	*
chainguard	percona-server-9.6	*
chainguard	percona-server-9.1	*
chainguard	percona-server-8.3	*
wolfi	percona-server-8.3	*
wolfi	percona-server-9.4	*
chainguard	percona-server-8.0	*
chainguard	percona-server-9.0	*
n/a	n/a	*
wolfi	percona-server-9.5	*
wolfi	percona-server-9.0	*
chainguard	percona-server-9.5	*
wolfi	percona-server-9.1	*
chainguard	percona-server-9.4	*
wolfi	percona-server-8.4	*
wolfi	percona-server-9.6	*
chainguard	percona-server-9.7	*

Timeline

Nov 9, 2020 CVE Published
Apr 14, 2021 EPSS Score (30 in total, the first dated here)
Aug 4, 2024 CVE Updated
Apr 3, 2026 Security Advisory
Sep 1, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2020-26542
vulnetix vdb fixes CVE-2020-26542

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2020-26542/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

x_refsource_CONFIRM
x_refsource_MISC
x_refsource_MISC
x_refsource_CONFIRM

Look up in the Resolve Platform →