Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired c…

published 2020-12-10 5 y ago modified 2026-06-17 4 mo ago also EUVD-2020-22025

cvss: 3.7; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.0%; EPSS 2.0% chance of exploitation in 30 days, percentile 80%
public exploits: 0; none known

Sympa before 6.2.59b.2 allows remote attackers to obtain full SOAP API access by sending any arbitrary string (except one from an expired cookie) as the cookie value to authenticateAndRun.

Patch / fix

distros 1 links 2

sympa Debian 14, Debian 13, Debian 12 6.2.58~dfsg-2

debian advisories DEBIAN-CVE-2020-29668

github.com/sympa-community/sympa#1044 pull request
github.com/sympa-community/sympa/issues/1041 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-29668 updated 2025-11-21 cvss 8.1

sympa: allows remote attackers to obtain full SOAP API access via illegal cookie

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.98% chance of exploitation in the next 30 days, higher than 80% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/sympa-community/sympa/issues/1041 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	3.7	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD	2.0	4.3	AV:N/AC:M/Au:N/C:P/I:N/A:N

Classification

Weakness

CWE-287 Improper Authentication
CWE-565 Reliance on Cookies without Validation and Integrity Checking

References

github.com /sympa-community/sympa/pull/1044
patch, third-party-advisory
github.com /sympa-community/sympa/issues/1041
exploit, patch, third-party-advisory
debian.org /security/2020/dsa-4818
vendor-advisory, third-party-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/JICIHAJKKCZXJNIICUDYXGZFQCN6J4U6/
vendor-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/EFZWDEKQFW3EH665OECDWIWM2MI7T53Y/
vendor-advisory
github.com /sympa-community/sympa/blob/6.2.59b.2/NEWS.md
release-notes, third-party-advisory
bugs.debian.org /cgi-bin/bugreport.cgi?bug=976020
mailing-list, third-party-advisory
lists.debian.org /debian-lts-announce/2020/12/msg00026.html
mailing-list, third-party-advisory

Sources

CVE List CVE-2020-29668
NVD CVE-2020-29668

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary