CVE-2020-26214 is a vulnerability in the Alerta server caused by improper authentication. CVE-2020-26214 is a flaw in the Alerta server caused by incorrect authentication. Users may be able to bypass LDAP authentication in Alerta prior to version 8.1.0 by using an empty password if the server is configured to use LDAP as the authorization provider. Only deployments with LDAP servers configured to enable anonymous authentication with no authentication are qualified. Only LDAP servers designed to allow anonymous authorization through unauthenticated authentication are affected. For any authentication attempts where the password field is empty, a patch has been introduced in version 8.1.0 that returns an HTTP 401 unauthorized response.
Mitigation / Precaution
We suggest that you update to version 8.1.0 in order to fix this vulnerability.
