Vulnerability · Published Apr 29, 2020 · Assigned by GitHub_M

CVE-2020-11020Authentication and extension bypass in Faye

High 8.5

In plain English

A high-severity improper authentication in Faye from faye. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.5High

Exploit odds (30 days)1.6%top 24.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Faye (NPM, RubyGem) versions greater than 0.5.0 and before 1.0.4, 1.1.3 and 1.2.5, has the potential for authentication bypass in the extension system. The vulnerability allows any client to bypass checks put in place by server-side extensions, by appending extra segments to the message channel. It is patched in versions 1.0.4, 1.1.3 and 1.2.5.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	ruby-faye	1.4.0-1	DEBIAN-CVE-2020-11020
RubyGems	faye	1.0.4	GHSA-qpg4-4w7w-2mq5
RubyGems	faye	1.1.3	GHSA-qpg4-4w7w-2mq5
RubyGems	faye	1.2.5	GHSA-qpg4-4w7w-2mq5
Ubuntu:22.04:LTS	ruby-faye	no fix listed	UBUNTU-CVE-2020-11020
Ubuntu:24.04:LTS	ruby-faye	no fix listed	UBUNTU-CVE-2020-11020

Affected products (as reported)

Vendor	Product	Versions
faye	Faye	>= 0.5.0, < 1.0.4>= 1.1.0, < 1.1.3>= 1.2.0, < 1.2.5

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

References

https://github.com/faye/faye/security/advisories/GHSA-qpg4-4w7w-2mq5 x_refsource_CONFIRM
https://github.com/faye/faye/commit/65d297d341b607f3cb0b5fa6021a625a991cc30e x_refsource_MISC