CVE-2020-8086

The mod_auth_ldap and mod_auth_ldap2 Community Modules through 2020-01-27 for Prosody incompletely verify the XMPP address passed to the is_admin() function. This grants remote entities admin-only functionality if their username matches the username of a local admin.

• CWE-863

• https://hg.prosody.im/prosody-modules/log/tip/mod_auth_ldap/mod_auth_ldap.luaThird Party Advisory
• https://hg.prosody.im/prosody-modules/log/tip/mod_auth_ldap2/mod_auth_ldap2.luaThird Party Advisory
• https://prosody.im/security/advisory_20200128/Vendor Advisory
• https://seclists.org/bugtraq/2020/Feb/5Mailing List, Third Party Advisory
• https://www.debian.org/security/2020/dsa-4612Third Party Advisory
• https://hg.prosody.im/prosody-modules/log/tip/mod_auth_ldap/mod_auth_ldap.luaThird Party Advisory
• https://hg.prosody.im/prosody-modules/log/tip/mod_auth_ldap2/mod_auth_ldap2.luaThird Party Advisory
• https://prosody.im/security/advisory_20200128/Vendor Advisory
• https://seclists.org/bugtraq/2020/Feb/5Mailing List, Third Party Advisory
• https://www.debian.org/security/2020/dsa-4612Third Party Advisory

Published

Jan 28, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-8032A Insecure Temporary File vulnerability in the packaging of …7
• CVE-2020-8033Ruckus R500 3.4.2.0.384 devices allow XSS via the index.asp …6.1
• CVE-2020-8034Gollem before 3.0.13, as used in Horde Groupware Webmail Edi…6.1
• CVE-2020-8035The image view functionality in Horde Groupware Webmail Edit…6.1
• CVE-2020-8036The tok2strbuf() function in tcpdump 4.10.0-PRE-GIT was used…7.5
• CVE-2020-8037The ppp decapsulator in tcpdump 4.9.3 can be convinced to al…7.5
• CVE-2020-8087SMC Networks D3G0804W D3GNV5M-3.5.1.6.10_GA devices allow re…9.8
• CVE-2020-8088panel_login.php in UseBB 1.0.12 allows type juggling for log…9.8
• CVE-2020-8089Piwigo 2.10.1 is affected by stored XSS via the Group Name F…5.4
• CVE-2020-8090The Username field in the Storage Service settings of A1 WLA…4.8
• CVE-2020-8091svg.swf in TYPO3 6.2.0 to 6.2.38 ELTS and 7.0.0 to 7.1.0 cou…6.1
• CVE-2020-8092A privilege escalation vulnerability in BDLDaemon as used in…5.5