CVE-2020-5616 Auth bypass in [Calendar01], [Calendar02], [PKOBO-News01], [PKOBO-vote01], [Telop01], [Gallery01], [CalendarForm01], and [Link01]
Remote attackers can bypass authentication to log in with administrative privileges in multiple PHP Factory plugins.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-5616?
CVE-2020-5616 is a critical authentication bypass vulnerability in PHP Factory [Calendar01], [Calendar02], [PKOBO-News01], [PKOBO-vote01], [Telop01], [Gallery01], [CalendarForm01], and [Link01], published on 4 Aug 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
[Calendar01], [Calendar02], [PKOBO-News01], [PKOBO-vote01], [Telop01], [Gallery01], [CalendarForm01], and [Link01] [Calendar01] free edition ver1.0.0, [Calendar02] free edition ver1.0.0, [PKOBO-News01] free edition ver1.0.3 and earlier, [PKOBO-vote01] free edition ver1.0.1 and earlier, [Telop01] free edition ver1.0.0, [Gallery01] free edition ver1.0.3 and earlier, [CalendarForm01] free edition ver1.0.3 and earlier, and [Link01] free edition ver1.0.0 allows remote attackers to bypass authentication and log in to the product with administrative privileges via unspecified vectors.
Weakness: CWE-287
Which versions are affected by CVE-2020-5616?
It affects 8 products.
Products include Calendar01 Project Calendar01, Calendar02 Project Calendar02, Calendarform01 Project Calendarform01, Gallery01 Project Gallery01, Link01 Project Link01, Pkobo-News01 Project Pkobo-News01 and 2 more.
How do I fix CVE-2020-5616?
No fix has been published for CVE-2020-5616 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-5616 being exploited?
There is no known exploitation of CVE-2020-5616 in the wild and no public exploit code.
Other vulnerabilities in PHP Factory [Calendar01], [Calendar02], [PKOBO-News01], [PKOBO-vote01], [Telop01], [Gallery01], [CalendarForm01], and [Link01]
Sources
Also known as GHSA-73rh-fgwv-4hpw.