Critical severity9.8NVD Advisory· Published Jan 28, 2020· Updated Jun 17, 2026

CVE-2020-8086

Description

The mod_auth_ldap and mod_auth_ldap2 Community Modules through 2020-01-27 for Prosody incompletely verify the XMPP address passed to the is_admin() function. This grants remote entities admin-only functionality if their username matches the username of a local admin.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Prosody/Mod Auth Ldap2
cpe:2.3:a:prosody:mod_auth_ldap2:*:*:*:*:*:*:*:*
Range: <=2020-01-27
Prosody/Mod Auth LDAP
cpe:2.3:a:prosody:mod_auth_ldap:*:*:*:*:*:*:*:*
Range: <=2020-01-27
Debian/linux2 versions
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Prosody/Prosodydescription
Prosody/Prosodyllm-fuzzy

Patches

Vulnerability mechanics

References

hg.prosody.im/prosody-modules/log/tip/mod_auth_ldap/mod_auth_ldap.luanvdThird Party Advisory
hg.prosody.im/prosody-modules/log/tip/mod_auth_ldap2/mod_auth_ldap2.luanvdThird Party Advisory
prosody.im/security/advisory_20200128/nvdVendor Advisory
seclists.org/bugtraq/2020/Feb/5nvdMailing ListThird Party Advisory
www.debian.org/security/2020/dsa-4612nvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000