CVE-2019-20933

InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).

Affected products

Alt Linux, Influxdb, Linuxmint, Ubuntu

Influxdata Influxdb

< 1.7.6

Fix

Available

CVSS 3.1

9.8 CRITICAL

EPSS

30.9% (98th percentile)

Weakness

CWE-287

NVD status

Modified

Published

2020-11-19