要点
- CVE-2020-23355 是影响 codiad/codiad, codiad (codiad) 的高危 (CVSS 7.5)漏洞。
- 未来 30 天内被利用的概率（EPSS）：1.00%，高于 62.7% 的漏洞。
- 暂无已修复版本：请关注参考资料中的厂商公告。
| Package | Affected versions | Patched versions |
|---|
| codiad/codiad Packagist | ≤ 2.8.4
| No fix yet |
| codiad | = 2.8.4
| No fix yet |
Description
Codiad 2.8.4 /componetns/user/class.user.php:Authenticate() is vulnerable in magic hash authentication bypass. If encrypted or hash value for the passwords form certain formats of magic hash, e.g, 0e123, another hash value 0e234[something] can successfully authenticate.
NVD description
** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Codiad 2.8.4 /componetns/user/class.user.php:Authenticate() is vulnerable in magic hash authentication bypass. If encrypted or hash value for the passwords form certain formats of magic hash, e.g, 0e123, another hash value 0e234 something can successfully authenticate.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free