CVE-2019-20933
CRITICAL EXPLOITED NUCLEIInfluxDB <1.7.6 - Auth Bypass
Title source: llmDescription
InfluxDB before 1.7.6 has an authentication bypass vulnerability in the authenticate function in services/httpd/handler.go because a JWT token may have an empty SharedSecret (aka shared secret).
Exploits (2)
nomisec
WORKING POC
42 stars
by LorenzoTullini · remote
https://github.com/LorenzoTullini/InfluxDB-Exploit-CVE-2019-20933
Nuclei Templates (1)
InfluxDB <1.7.6 - Authentication Bypass
CRITICALVERIFIEDby pussycat0x,c-sh0
Shodan:
InfluxDB || http.title:"influxdb - admin interface" || influxdb
FOFA:
title="influxdb - admin interface"
References (5)
Scores
CVSS v3
9.8
EPSS
0.9397
EPSS Percentile
99.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
VulnCheck KEV
2023-11-29
CWE
CWE-287
Status
published
Products (4)
debian/debian_linux
9.0
debian/debian_linux
10.0
influxdata/influxdb
< 1.7.6
influxdata/influxdb
0 - 1.7.6Go
Published
Nov 19, 2020
Tracked Since
Feb 18, 2026