CVE-2020-13776CWE-269privilege-escalation

CVE-2020-13776

Medium · published June 3, 2020

CVSS v3.1
6.7
EPSS
0%
Percentile
38.9
In the wild
Unconfirmed
What it is

systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.

The record
Technical detail
CVSS v3.1
6.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00461 · 38.9th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2020-06-03T07:15Z
Affected products (4)
ProductVersionsFixed in
systemd_project/systemd≤ 245—
netapp/active_iq_unified_managerall versions—
netapp/solidfire_\&_hci_management_nodeall versions—
fedoraproject/fedoraall versions—
References (7)
https://github.com/systemd/systemd/issues/15985 · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYGLFEKG45EYBJ7TPQMLWROWPTZBEU63/ · [email protected]https://security.netapp.com/advisory/ntap-20200611-0003/ · [email protected]https://github.com/systemd/systemd/issues/15985 · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYGLFEKG45EYBJ7TPQMLWROWPTZBEU63/ · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20200611-0003/ · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 03 JUN 02:05Z
    systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root…
    cvelistv5