CVE-2020-14004

Katalog CVE

CVSS 7.8 · High EPSS 0,74%

Kerentanan Improper Link Resolution Before File Access ('Link Following') pada icinga, opensuse backports sle +1 lainnya. Skor CVSS 3.1 7.8 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Icinga2 before v2.12.0-rc1. The prepare-dirs script (run as part of the icinga2 systemd service) executes chmod 2750 /run/icinga2/cmd. /run/icinga2 is under control of an unprivileged user by default. If /run/icinga2/cmd is a symlink, then it will by followed and arbitrary files can be changed to mode 2750 by the unprivileged icinga2 user.

Rincian

Terbit di NVD

12 Juni 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.8 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-59: Improper Link Resolution Before File Access ('Link Following')

EPSS (30 hari)

0,74% peluang dieksploitasi; lebih tinggi dari 53,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Icinga/icinga2/pull/8045/commits/2f0f2e8c355b75fa4407d23f85feea037d2bc4b6 patch · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00014.html broken link · mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2020/06/12/1 exploit · mailing list · advisory pihak ketiga
• https://github.com/Icinga/icinga2/compare/v2.12.0-rc1...master advisory pihak ketiga
• https://github.com/Icinga/icinga2/releases release notes · advisory pihak ketiga
• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2020-14004 broken link · issue tracking