LowFix available
sympa — security advisory
Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun.
- Products
- sympa
- Affected versions
- Not specified
- Fixed versions
- 6.2.58~dfsg-2
- CVEs
- CVE-2020-29668
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 13:13 UTC · Revision 1
Source evidence
Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun.
osv:DEBIAN-CVE-2020-29668
sympa
Fixed versions: 6.2.58~dfsg-2
sympa
Fixed versions: 6.2.58~dfsg-2
sympa
Fixed versions: 6.2.58~dfsg-2
Complete source record
{
"id": "bffe45baa297382e4ad97f22ad430524524ed0c7f7de67b2632eaa62f2134f80",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2020-29668",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2020-29668",
"summary": "Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun.",
"evidence": "osv:DEBIAN-CVE-2020-29668",
"products": [
{
"name": {
"value": "sympa",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.2.58~dfsg-2",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "sympa",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.2.58~dfsg-2",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "sympa",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "6.2.58~dfsg-2",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "low",
"structured": {
"id": "DEBIAN-CVE-2020-29668",
"aliases": [
"DEBIAN-CVE-2020-29668"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.2.58~dfsg-2"
}
]
}
],
"package": {
"name": "sympa",
"purl": "pkg:deb/debian/sympa?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-29668.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.2.58~dfsg-2"
}
]
}
],
"package": {
"name": "sympa",
"purl": "pkg:deb/debian/sympa?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-29668.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.2.58~dfsg-2"
}
]
}
],
"package": {
"name": "sympa",
"purl": "pkg:deb/debian/sympa?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2020-29668.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-26T12:01:58.947176500Z",
"provider": "osv",
"upstream": [
"CVE-2020-29668"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2020-29668"
]
},
"related_cves": [
{
"value": "CVE-2020-29668",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 451942,
"published_at": "2020-12-10T08:15:11.41+00:00"
}