CVE-2020-14342
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.4epss 0.7%
probabilidade de exploração
0.7%top 52% das CVEs
exploração observada
nãonenhuma fonte reporta
It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Produtos afetados
samba · cifs-utilsReferências
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00109.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14342https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DUMRICFXJVCBBOSKZSKT3HFVQM6VPJU3/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JBNFSTJOQWVPFZAUJNNMAPY45PW5RTTE/https://lists.samba.org/archive/samba-technical/2020-September/135747.htmlhttps://security.gentoo.org/glsa/202009-16