CVE-2020-25719

Katalog CVE

CVSS 7.2 · High EPSS 1,7%

Kerentanan Improper Authentication pada samba, debian linux +15 lainnya. Skor CVSS 3.1 7.2 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total domain compromise.

Rincian

Terbit di NVD

18 Februari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-287: Improper Authentication
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 76,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.samba.org/samba/security/CVE-2020-25719.html mitigasi · advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2019732 issue tracking · patch · advisory pihak ketiga
• https://security.gentoo.org/glsa/202309-06