CVE-2020-11081

Katalog CVE

CVSS 8.2 · High EPSS 0,59%

Kerentanan Process Control pada linuxfoundation osquery. Skor CVSS 3.1 8.2 (High) menurut NVD.

Deskripsi (NVD)

osquery before version 4.4.0 enables a privilege escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables local escalation. This is fixed in version 4.4.0.

Rincian

Terbit di NVD

10 Juli 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.2 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-114: Process Control
CWE-426: Untrusted Search Path

EPSS (30 hari)

0,59% peluang dieksploitasi; lebih tinggi dari 46,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/osquery/osquery/commit/4d4957f12a6aa0becc9d01d9f97061e1e3d809c5 patch · advisory pihak ketiga
• https://github.com/osquery/osquery/pull/6433 patch · advisory pihak ketiga
• https://github.com/osquery/osquery/issues/6426 exploit · issue tracking · advisory pihak ketiga
• https://github.com/osquery/osquery/releases/tag/4.4.0 release notes · advisory pihak ketiga
• https://github.com/osquery/osquery/security/advisories/GHSA-2xwp-8fv7-c5pm advisory pihak ketiga