Improper Authentication in InfluxDB - CVE-2019-20933
Published: November 19, 2020 / Updated: April 28, 2021
Vulnerability identifier: #VU49209
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-20933
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due the JWT token may have an empty SharedSecret in the authenticate function in services/httpd/handler.go. A remote non-authenticated attacker can bypass authentication process and gain unauthorized access to the application.
Affected software
InfluxDB
influxdb (Debian package)
influxdb (Ubuntu package)
Ubuntu
influxdb (Debian package)
influxdb (Ubuntu package)
Ubuntu
How to mitigate CVE-2019-20933
Install updates from vendor's website.
InfluxDB - update to 1.7.6
influxdb (Debian package) - update to 1.6.4-1+deb10u1
influxdb (Ubuntu package) - addressed in versions 1.1.1+dfsg1-4+deb9u1ubuntu1, 1.6.4-1+deb10u1build0.20.04.1
influxdb (Debian package) - update to 1.6.4-1+deb10u1
influxdb (Ubuntu package) - addressed in versions 1.1.1+dfsg1-4+deb9u1ubuntu1, 1.6.4-1+deb10u1build0.20.04.1