{"api_version":"1","generated_at":"2026-04-24T05:05:24+00:00","cve":"CVE-2020-26214","urls":{"html":"https://cve.report/CVE-2020-26214","api":"https://cve.report/api/cve/CVE-2020-26214.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2020-26214","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-26214"},"summary":{"title":"CVE-2020-26214","description":"In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider. Only deployments where LDAP servers are configured to allow unauthenticated authentication mechanism for anonymous authorization are affected. A fix has been implemented in version 8.1.0 that returns HTTP 401 Unauthorized response for any authentication attempts where the password field is empty. As a workaround LDAP administrators can disallow unauthenticated bind requests by clients.","state":"PUBLIC","assigner":"security-advisories@github.com","published_at":"2020-11-06 18:15:00","updated_at":"2020-11-17 21:08:00"},"problem_types":["CWE-287"],"metrics":[],"references":[{"url":"https://pypi.org/project/alerta-server/8.1.0/","name":"https://pypi.org/project/alerta-server/8.1.0/","refsource":"MISC","tags":["Third Party Advisory"],"title":"alerta-server · PyPI","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://tools.ietf.org/html/rfc4513#section-5.1.2","name":"https://tools.ietf.org/html/rfc4513#section-5.1.2","refsource":"MISC","tags":["Third Party Advisory"],"title":"RFC 4513 - Lightweight Directory Access Protocol (LDAP): Authentication Methods and Security Mechanisms","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/alerta/alerta/commit/2bfa31779a4c9df2fa68fa4d0c5c909698c5ef65","name":"https://github.com/alerta/alerta/commit/2bfa31779a4c9df2fa68fa4d0c5c909698c5ef65","refsource":"MISC","tags":["Patch","Third Party Advisory"],"title":"Merge pull request #1345 from alerta/fix-ldap-empty-bind · alerta/alerta@2bfa317 · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/alerta/alerta/issues/1277","name":"https://github.com/alerta/alerta/issues/1277","refsource":"MISC","tags":["Third Party Advisory"],"title":"Disallow LDAP anonymous bind · Issue #1277 · alerta/alerta · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/alerta/alerta/security/advisories/GHSA-5hmm-x8q8-w5jh","name":"https://github.com/alerta/alerta/security/advisories/GHSA-5hmm-x8q8-w5jh","refsource":"CONFIRM","tags":["Third Party Advisory"],"title":"LDAP authentication bypass with empty password · Advisory · alerta/alerta · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://github.com/alerta/alerta/pull/1345","name":"https://github.com/alerta/alerta/pull/1345","refsource":"MISC","tags":["Third Party Advisory"],"title":"Do not allow LDAP login with empty password by satterly · Pull Request #1345 · alerta/alerta · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-26214","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-26214","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2020","cve_id":"26214","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"alerta_project","cpe5":"alerta","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2020","cve_id":"26214","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"alerta_project","cpe5":"alerta","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2020-26214","qid":"983216","title":"Python (pip) Security Update for alerta-server (GHSA-5hmm-x8q8-w5jh)"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"security-advisories@github.com","ID":"CVE-2020-26214","STATE":"PUBLIC","TITLE":"LDAP authentication bypass in Alerta"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"alerta","version":{"version_data":[{"version_value":"< 8.1.0"}]}}]},"vendor_name":"alerta"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider. Only deployments where LDAP servers are configured to allow unauthenticated authentication mechanism for anonymous authorization are affected. A fix has been implemented in version 8.1.0 that returns HTTP 401 Unauthorized response for any authentication attempts where the password field is empty. As a workaround LDAP administrators can disallow unauthenticated bind requests by clients."}]},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-287: Improper Authentication"}]}]},"references":{"reference_data":[{"name":"https://github.com/alerta/alerta/security/advisories/GHSA-5hmm-x8q8-w5jh","refsource":"CONFIRM","url":"https://github.com/alerta/alerta/security/advisories/GHSA-5hmm-x8q8-w5jh"},{"name":"https://github.com/alerta/alerta/issues/1277","refsource":"MISC","url":"https://github.com/alerta/alerta/issues/1277"},{"name":"https://github.com/alerta/alerta/pull/1345","refsource":"MISC","url":"https://github.com/alerta/alerta/pull/1345"},{"name":"https://github.com/alerta/alerta/commit/2bfa31779a4c9df2fa68fa4d0c5c909698c5ef65","refsource":"MISC","url":"https://github.com/alerta/alerta/commit/2bfa31779a4c9df2fa68fa4d0c5c909698c5ef65"},{"name":"https://pypi.org/project/alerta-server/8.1.0/","refsource":"MISC","url":"https://pypi.org/project/alerta-server/8.1.0/"},{"name":"https://tools.ietf.org/html/rfc4513#section-5.1.2","refsource":"MISC","url":"https://tools.ietf.org/html/rfc4513#section-5.1.2"}]},"source":{"advisory":"GHSA-5hmm-x8q8-w5jh","discovery":"UNKNOWN"}},"nvd":{"publishedDate":"2020-11-06 18:15:00","lastModifiedDate":"2020-11-17 21:08:00","problem_types":["CWE-287"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"},"exploitabilityScore":3.9,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":7.5},"severity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:alerta_project:alerta:*:*:*:*:*:*:*:*","versionEndExcluding":"7.5.7","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:alerta_project:alerta:*:*:*:*:*:*:*:*","versionStartIncluding":"8.0.0","versionEndExcluding":"8.1.0","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2020","CveId":"26214","Ordinal":"187636","Title":"CVE-2020-26214","CVE":"CVE-2020-26214","Year":"2020"},"notes":[{"CveYear":"2020","CveId":"26214","Ordinal":"1","NoteData":"In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider. Only deployments where LDAP servers are configured to allow unauthenticated authentication mechanism for anonymous authorization are affected. A fix has been implemented in version 8.1.0 that returns HTTP 401 Unauthorized response for any authentication attempts where the password field is empty. As a workaround LDAP administrators can disallow unauthenticated bind requests by clients.","Type":"Description","Title":null},{"CveYear":"2020","CveId":"26214","Ordinal":"2","NoteData":"2020-11-06","Type":"Other","Title":"Published"},{"CveYear":"2020","CveId":"26214","Ordinal":"3","NoteData":"2020-11-06","Type":"Other","Title":"Modified"}]}}}