{"api_version":"1","generated_at":"2026-07-23T11:44:18+00:00","cve":"CVE-2020-11020","urls":{"html":"https://cve.report/CVE-2020-11020","api":"https://cve.report/api/cve/CVE-2020-11020.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-11020","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-11020"},"summary":{"title":"CVE-2020-11020","description":"Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1.0.4, 1.1.3 and 1.2.5, has the potential for authentication bypass in the extension system. The vulnerability allows any client to bypass checks put in place by server-side extensions, by appending extra segments to the message channel. It is patched in versions 1.0.4, 1.1.3 and 1.2.5.","state":"PUBLIC","assigner":"security-advisories@github.com","published_at":"2020-04-29 18:15:00","updated_at":"2020-05-06 18:21:00"},"problem_types":["CWE-287"],"metrics":[],"references":[{"url":"https://github.com/faye/faye/security/advisories/GHSA-qpg4-4w7w-2mq5","name":"https://github.com/faye/faye/security/advisories/GHSA-qpg4-4w7w-2mq5","refsource":"CONFIRM","tags":["Exploit","Mitigation","Third Party Advisory"],"title":"Authentication and extension bypass · Advisory · faye/faye · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/faye/faye/commit/65d297d341b607f3cb0b5fa6021a625a991cc30e","name":"https://github.com/faye/faye/commit/65d297d341b607f3cb0b5fa6021a625a991cc30e","refsource":"MISC","tags":["Patch","Third Party Advisory"],"title":"Strict meta channel recognition in server · faye/faye@65d297d · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-11020","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11020","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2020","cve_id":"11020","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"faye_project","cpe5":"faye","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"node.js","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"11020","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"faye_project","cpe5":"faye","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"ruby","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"11020","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"faye_project","cpe5":"faye","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"node.js","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"11020","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"faye_project","cpe5":"faye","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"ruby","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2020-11020","qid":"180610","title":"Debian Security Update for ruby-faye (CVE-2020-11020)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security-advisories@github.com","ID":"CVE-2020-11020","STATE":"PUBLIC","TITLE":"Authentication and extension bypass in Faye"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Faye","version":{"version_data":[{"version_value":">= 0.5.0, < 1.0.4"},{"version_value":">= 1.1.0, < 1.1.3"},{"version_value":">= 1.2.0, < 1.2.5"}]}}]},"vendor_name":"faye"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1.0.4, 1.1.3 and 1.2.5, has the potential for authentication bypass in the extension system. The vulnerability allows any client to bypass checks put in place by server-side extensions, by appending extra segments to the message channel. It is patched in versions 1.0.4, 1.1.3 and 1.2.5."}]},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-287: Improper Authentication"}]}]},"references":{"reference_data":[{"name":"https://github.com/faye/faye/security/advisories/GHSA-qpg4-4w7w-2mq5","refsource":"CONFIRM","url":"https://github.com/faye/faye/security/advisories/GHSA-qpg4-4w7w-2mq5"},{"name":"https://github.com/faye/faye/commit/65d297d341b607f3cb0b5fa6021a625a991cc30e","refsource":"MISC","url":"https://github.com/faye/faye/commit/65d297d341b607f3cb0b5fa6021a625a991cc30e"}]},"source":{"advisory":"GHSA-qpg4-4w7w-2mq5","discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2020-04-29 18:15:00","lastModifiedDate":"2020-05-06 18:21:00","problem_types":["CWE-287"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"},"exploitabilityScore":3.9,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":7.5},"severity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:faye_project:faye:*:*:*:*:*:ruby:*:*","versionStartExcluding":"0.5.0","versionEndExcluding":"1.0.4","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:faye_project:faye:*:*:*:*:*:ruby:*:*","versionStartIncluding":"1.1.0","versionEndExcluding":"1.1.3","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:faye_project:faye:*:*:*:*:*:ruby:*:*","versionStartIncluding":"1.2.0","versionEndExcluding":"1.2.5","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:faye_project:faye:*:*:*:*:*:node.js:*:*","versionStartIncluding":"1.2.0","versionEndExcluding":"1.2.5","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:faye_project:faye:*:*:*:*:*:node.js:*:*","versionStartIncluding":"1.1.0","versionEndExcluding":"1.1.3","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:faye_project:faye:*:*:*:*:*:node.js:*:*","versionStartExcluding":"0.5.0","versionEndExcluding":"1.0.4","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"11020","Ordinal":"171565","Title":"CVE-2020-11020","CVE":"CVE-2020-11020","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"11020","Ordinal":"1","NoteData":"Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1.0.4, 1.1.3 and 1.2.5, has the potential for authentication bypass in the extension system. The vulnerability allows any client to bypass checks put in place by server-side extensions, by appending extra segments to the message channel. It is patched in versions 1.0.4, 1.1.3 and 1.2.5.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"11020","Ordinal":"2","NoteData":"2020-04-29","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"11020","Ordinal":"3","NoteData":"2020-04-29","Type":"Other","Title":"Modified"}]}}}