CVE-2020-10539 Hardcoded credentials in n/a
A hardcoded backdoor password allows attackers to bypass authentication and gain unauthorized access to the Epikur server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-10539?
CVE-2020-10539 is a critical vulnerability in n/a, published on 5 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in Epikur before 20.1.1. The Epikur server contains the checkPasswort() function that, upon user login, checks the submitted password against the user password's MD5 hash stored in the database. It is also compared to a second MD5 hash, which is the same for every user (aka a "Backdoor Password" of 3p1kursupport). If the submitted password matches either one, access is granted.
Weakness: CWE-287
Which versions are affected by CVE-2020-10539?
It affects 1 product.
Products include Epikur Epikur.
How do I fix CVE-2020-10539?
No fix has been published for CVE-2020-10539 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-10539 being exploited?
There is no known exploitation of CVE-2020-10539 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-q4x8-w6fw-v9hh.