CVE-2020-8591

Name of the Vulnerable Software and Affected Versions eG Manager version 7.1.2

Description The issue allows authentication bypass. This can be achieved via a request to the com.egurkha.EgLoginServlet endpoint with specific parameters, including uname, upass, and accessKey. For example, a request with uname=admin, upass=, and accessKey=eGm0n1t0r can bypass authentication.

Recommendations For eG Manager version 7.1.2, as a temporary workaround, consider restricting access to the com.egurkha.EgLoginServlet endpoint until a patch is available. Avoid using the parameters uname, upass, and accessKey in this endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.