CVE-2020-27220 Missing authorization in Eclipse Hono
Authenticated devices can receive unauthorized command and control messages intended for other devices within the same tenant due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-27220?
CVE-2020-27220 is a high-severity missing authorization vulnerability in The Eclipse Foundation Eclipse Hono, published on 14 Jan 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Eclipse Hono AMQP and MQTT protocol adapters do not check whether an authenticated gateway device is authorized to receive command & control messages when it has subscribed only to commands for a specific device. The missing check involves verifying that the command target device is configured giving permission for the gateway device to act on its behalf. This means an authenticated device of a certain tenant, notably also a non-gateway device acting like a gateway, may receive command & control messages targeted at a different device of the same tenant without corresponding permissions getting checked.
Weakness: CWE-862
Which versions are affected by CVE-2020-27220?
It affects 1 product.
Products include Eclipse Hono.
How do I fix CVE-2020-27220?
No fix has been published for CVE-2020-27220 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-27220 being exploited?
There is no known exploitation of CVE-2020-27220 in the wild and no public exploit code.
Other vulnerabilities in The Eclipse Foundation Eclipse Hono
Sources
Also known as GHSA-2jmj-6ff4-3p3w.