{"action":"Upgrade alerta-server to 7.5.7 or later.","affected":[{"fixed":"7.5.7","introduced":"0"},{"fixed":"8.1.0","introduced":"8.0.0"}],"component":"alerta-server","cve_ids":["CVE-2020-26214"],"ecosystem":"PyPI","epss":0.65933,"exploited":false,"fixed_versions":["7.5.7","8.1.0"],"ghsa_id":"GHSA-5hmm-x8q8-w5jh","id":"tcs_01M5KG9MQRVFG4G7YKXS8JPX5T","modified_at":"2023-11-08T04:03:14.621217Z","published_at":"2020-11-06T18:15:00Z","references":["https://osv.dev/vulnerability/PYSEC-2020-159","https://github.com/alerta/alerta/issues/1277","https://pypi.org/project/alerta-server/8.1.0/","https://github.com/alerta/alerta/security/advisories/GHSA-5hmm-x8q8-w5jh","https://github.com/alerta/alerta/commit/2bfa31779a4c9df2fa68fa4d0c5c909698c5ef65","https://tools.ietf.org/html/rfc4513#section-5.1.2","https://github.com/alerta/alerta/pull/1345"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2020-159","url":"https://osv.dev/vulnerability/PYSEC-2020-159"}],"summary":"In Alerta before version 8.1.0, users may be able to bypass LDAP authentication if they provide an empty password when Alerta server is configure to use LDAP as the authorization provider. Only deploy"}