Skip to main content

Phplist CVE-2020-8547

CRITICAL
2020-02-03 cve@mitre.org
Authentication Bypass Phplist
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Feb 03, 2020 - 16:15 nvd
CRITICAL 9.8

DescriptionNVD

phpList 3.5.0 allows type juggling for admin login bypass because is used instead of = for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters.

AnalysisAI

phpList 3.5.0 allows type juggling for admin login bypass because is used instead of = for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

phpList 3.5.0 allows type juggling for admin login bypass because is used instead of = for password hashes, which mishandles hashes that begin with 0e followed by exclusively numerical characters. Affected products include: Phplist.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Phplist

View all
CVE-2021-3188 CRITICAL POC
9.8 Jan 26

phpList 3.6.0 allows CSV injection, related to the email parameter, and /lists/admin/ exports. Rated critical severity (
CVE-2020-15072 HIGH POC
8.8 Jul 08

An issue was discovered in phpList through 3.5.4. Rated high severity (CVSS 8.8), this vulnerability is remotely exploit
CVE-2012-2740 HIGH POC
7.5 Sep 06

SQL injection vulnerability in public_html/lists/admin in phpList before 2.10.18 allows remote attackers to execute arbi
CVE-2012-3953 HIGH POC
7.5 Aug 12

SQL injection vulnerability in admin/index.php in phpList before 2.10.19 allows remote administrators to execute arbitra
CVE-2020-35708 HIGH POC
7.2 Dec 25

phpList 3.5.9 allows SQL injection by admins who provide a crafted fourth line of a file to the "Config - Import Adminis
CVE-2014-2916 MEDIUM POC
6.8 May 05

Cross-site request forgery (CSRF) vulnerability in the subscription page editor (spageedit) in phpList before 3.0.6 allo
CVE-2012-2741 MEDIUM POC
4.3 Sep 06

Cross-site scripting (XSS) vulnerability in public_html/lists/admin/ in phpList before 2.10.18 allows remote attackers t
CVE-2023-27576 MEDIUM POC
6.7 Aug 18

An issue was discovered in phpList before 3.6.14. Rated medium severity (CVSS 6.7), this vulnerability is low attack com
CVE-2020-13827 MEDIUM POC
6.1 Jun 04

phpList before 3.5.4 allows XSS via /lists/admin/user.php and /lists/admin/users.php. Rated medium severity (CVSS 6.1),

CVE-2012-5228 MEDIUM POC
4.3 Oct 01

Cross-site scripting (XSS) vulnerability in admin/index.php in phplist 2.10.9, 2.10.17, and possibly other versions befo
CVE-2012-4246 MEDIUM POC
4.3 Aug 12

Multiple cross-site scripting (XSS) vulnerabilities in lists/admin/index.php in phpList before 2.10.19 allow remote atta
CVE-2020-15073 MEDIUM POC
5.4 Jul 08

An issue was discovered in phpList through 3.5.4. Rated medium severity (CVSS 5.4), this vulnerability is remotely explo

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2020-8547 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy