CVE-2020-19003 Verification check bypass in Gate One
Attackers can bypass origin verification checks to connect to Gate One instances from unauthorized hosts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-19003?
CVE-2020-19003 is a medium-severity vulnerability in n/a, published on 6 Oct 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue in Gate One 1.2.0 allows attackers to bypass to the verification check done by the origins list and connect to Gate One instances used by hosts not on the origins list.
Weakness: CWE-290
Which versions are affected by CVE-2020-19003?
3 open source packages ship an affected version, including gateone. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gateone PyPI | All versions | None |
gateone PyPI | All versions to 1.2.0 | None |
gateone PyPI | All versions to 1.2.0 | None |
Products include Liftoffsoftware Gate One.
How do I fix CVE-2020-19003?
No fix has been published for CVE-2020-19003 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-19003 being exploited?
There is no known exploitation of CVE-2020-19003 in the wild and no public exploit code.
Sources
Also known as GHSA-q6j2-g8qf-wvf7, PYSEC-2021-423.