CVE-2020-2944

CVSS 8.8 HIGHEPSS 1.8%

Vexday Risk Score

41Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 8.8EPSS 1.8%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

15 Apr 2020Published on NVD

21 Apr 2020Public PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Common Desktop Environment). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

Oracle Corporation · Solaris Operating System

public PoCs found — 2

cve_referencepacketstormsecurity.com/files/157280/Common-Desktop-Environment-1.6-Local-Privilege-Escalation.htmlunverified exploitdbwww.exploit-db.com/exploits/48359unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://packetstormsecurity.com/files/157280/Common-Desktop-Environment-1.6-Local-Privilege-Escalation.html http://seclists.org/fulldisclosure/2020/Apr/25 https://www.oracle.com/security-alerts/cpuapr2020.html http://www.openwall.com/lists/oss-security/2020/04/15/3