CVE-2020-36569

Authentication is globally bypassed in github.com/nanobox-io/golang-nanoauth between v0.0.0-20160722212129-ac0cc4484ad4 and v0.0.0-20200131131040-063a3fb69896 if ListenAndServe is called with an empty token.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
GoCNA
---
---
CVEADP
---
---
CISA-ADPADP
9.1 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 23%
VendorProductVersion
digitaloceangolang-nanoauth
2016-07-22 ≤
𝑥
≤ 2020-01-31
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/nanobox-io/golang-nanoauth/commit/063a3fb69896acf985759f0fe3851f15973993f3
https://github.com/nanobox-io/golang-nanoauth/pull/5
https://pkg.go.dev/vuln/GO-2020-0004
https://github.com/nanobox-io/golang-nanoauth/commit/063a3fb69896acf985759f0fe3851f15973993f3
https://github.com/nanobox-io/golang-nanoauth/pull/5
https://pkg.go.dev/vuln/GO-2020-0004