CVE-2020-35458

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection issue via the hawk_remember_me_id parameter in the login_from_cookie cookie. The user logout routine could be used by unauthenticated remote attackers to execute code as hauser.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Jan 12, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-354597.8An issue was discovered in ClusterLabs crmsh through 4.2.1. Local attackers able to call "crm history" (when "crm" is run) were able to exec CVE-2020-35465.3A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA) could allow an unau CVE-2020-354605.3common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writin CVE-2020-354629.8Version 3.16.0 of the CoScale agent Docker image contains a blank password for the root user. Systems deployed using affected versions of th CVE-2020-354639.8Version 1.0.0 of the Instana Dynamic APM Docker image contains a blank password for the root user. Systems deployed using affected versions CVE-2020-354649.8Version 1.3.0 of the Weave Cloud Agent Docker image contains a blank password for the root user. Systems deployed using affected versions of CVE-2020-354669.8The Blackfire Docker image through 2020-12-14 contains a blank password for the root user. Systems deployed using affected versions of the B CVE-2020-354679.8The Docker Docs Docker image through 2020-12-14 contains a blank password for the root user. Systems deployed using affected versions of the CVE-2020-354689.8The Appbase streams Docker image 2.1.2 contains a blank password for the root user. Systems deployed using affected versions of the streams CVE-2020-354699.8The Software AG Terracotta Server OSS Docker image 5.4.1 contains a blank password for the root user. Systems deployed using affected versio CVE-2020-35476.5A vulnerability in the web-based management interface of Cisco AsyncOS software for Cisco Email Security Appliance (ESA), Cisco Content Secu CVE-2020-354708.8Envoy before 1.16.1 logs an incorrect downstream address because it considers only the directly connected peer, not the information in the p