CVE-2020-4042

CVE-2020-4042 is a medium-severity authentication bypass vulnerability affecting Bareos versions prior to 19.2.8. A malicious client can exploit this flaw by replaying the director's cram-md5 challenge back to itself, thereby tricking the director into providing a valid response without knowing the shared secret, provided the director allows client-initiated connections. The attack vector is network-based with high attack complexity, potentially leading to high integrity impact but no confidentiality or availability impact. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.