CVE-2020-11498

Slack Nebula through 1.1.0 contains a relative path vulnerability that allows a low-privileged attacker to execute code in the context of the root user via…

published April 2, 2020

CVSS
—
EPSS
3%
Percentile
88.8
In the wild
Unconfirmed
What it is

Slack Nebula through 1.1.0 contains a relative path vulnerability that allows a low-privileged attacker to execute code in the context of the root user via tun_darwin.go or tun_windows.go. A user can also use Nebula to execute arbitrary code in the user's own context, e.g., for user-level persistence or to bypass security controls. NOTE: the vendor states that this "requires a high degree of access and other preconditions that are tough to achieve."

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.03395 · 88.8th percentile
Published
2020-04-02T22:13Z
EPSS history
Timeline
  • 02 APR 22:13Z
    Slack Nebula through 1.1.0 contains a relative path vulnerability that allows a low-privileged attacker to execute code in the context of the root user via…
    cvelistv5