CVE-2020-15688

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The HTTP Digest Authentication in the GoAhead web server before 5.1.2 does not completely protect against replay attacks. This allows an unauthenticated remote attacker to bypass authentication via capture-replay if TLS is not used to protect the underlying communication channel.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-294

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/159505/EmbedThis-GoAhead-Web-Server-5.1.1-Digest-Authentication-Capture-Replay-Nonce-Reuse.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/embedthis/goahead-gpl/issues/3Third Party Advisory
https://github.com/embedthis/goahead-gpl/issues/3Third Party Advisory
https://github.com/embedthis/goahead-gpl/issues/3Third Party Advisory
https://github.com/embedthis/goahead-gpl/issues/3Third Party Advisory
http://packetstormsecurity.com/files/159505/EmbedThis-GoAhead-Web-Server-5.1.1-Digest-Authentication-Capture-Replay-Nonce-Reuse.htmlExploit, Third Party Advisory, VDB Entry
https://github.com/embedthis/goahead-gpl/issues/3Third Party Advisory
https://github.com/embedthis/goahead-gpl/issues/3Third Party Advisory
https://github.com/embedthis/goahead-gpl/issues/3Third Party Advisory
https://github.com/embedthis/goahead-gpl/issues/3Third Party Advisory

Timeline

Published: Jul 23, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-156897.5Appweb before 7.2.2 and 8.x before 8.1.0, when built with CGI support, mishandles an HTTP request with a Range header that lacks an exact ra CVE-2020-15697.8A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memo CVE-2020-156909.8In Nim before 1.2.6, the standard library asyncftpclient lacks a check for whether a message contains a newline character.CVE-2020-156929.8In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file pa CVE-2020-156936.5In Nim 1.2.4, the standard library httpClient is vulnerable to a CR-LF injection in the target URL. An injection is possible if the attacker CVE-2020-156947.5In Nim 1.2.4, the standard library httpClient fails to properly validate the server response. For example, httpClient.get().contentLength() CVE-2020-156956.3An issue was discovered in Joomla! through 3.9.19. A missing token check in the remove request section of com_privacy causes a CSRF vulnerab CVE-2020-156966.1An issue was discovered in Joomla! through 3.9.19. Lack of input filtering and escaping allows XSS attacks in mod_random_image.CVE-2020-156974.3An issue was discovered in Joomla! through 3.9.19. Internal read-only fields in the User table class could be modified by users.CVE-2020-156985.3An issue was discovered in Joomla! through 3.9.19. Inadequate filtering on the system information screen could expose Redis or proxy credent CVE-2020-156995.3An issue was discovered in Joomla! through 3.9.19. Missing validation checks on the usergroups table object can result in a broken site conf CVE-2020-15707.5A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulner