Vulnerability-Lookup

CVE-2020-13882 (GCVE-0-2020-13882)

Vulnerability from cvelistv5 – Published: 2020-06-18 17:35 – Updated: 2024-08-04 12:32

Summary

CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to check the log and report file permissions was not working as intended and could be bypassed locally. Because of the race, an unprivileged attacker can set up a log and report file, and control that up to the point where the specific routine is doing its check. After that, the file can be removed, recreated, and used for additional attacks.

Severity

4.2 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

CWE

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2339 records in the last 180 days details

References

4 references

URL	Tags
https://cisofy.com/security/cve/cve-2020-13882/	x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/pac…	vendor-advisoryx_refsource_FEDORA
https://cwe.mitre.org/data/definitions/367.html	x_refsource_MISC

Date Public

2020-06-18 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T12:32:14.209Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cisofy.com/security/cve/cve-2020-13882/"
          },
          {
            "name": "FEDORA-2020-f251753b0f",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDCHEKNR3HPJRNHE5PYKFH5GNBADTPA7/"
          },
          {
            "name": "FEDORA-2020-059e1591d6",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBFHIX6RTHCK37FXMAAXP4KGAMLUFDUD/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://cwe.mitre.org/data/definitions/367.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2020-06-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to check the log and report file permissions was not working as intended and could be bypassed locally. Because of the race, an unprivileged attacker can set up a log and report file, and control that up to the point where the specific routine is doing its check. After that, the file can be removed, recreated, and used for additional attacks."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-10T20:16:10.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cisofy.com/security/cve/cve-2020-13882/"
        },
        {
          "name": "FEDORA-2020-f251753b0f",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDCHEKNR3HPJRNHE5PYKFH5GNBADTPA7/"
        },
        {
          "name": "FEDORA-2020-059e1591d6",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBFHIX6RTHCK37FXMAAXP4KGAMLUFDUD/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://cwe.mitre.org/data/definitions/367.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-13882",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to check the log and report file permissions was not working as intended and could be bypassed locally. Because of the race, an unprivileged attacker can set up a log and report file, and control that up to the point where the specific routine is doing its check. After that, the file can be removed, recreated, and used for additional attacks."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cisofy.com/security/cve/cve-2020-13882/",
              "refsource": "CONFIRM",
              "url": "https://cisofy.com/security/cve/cve-2020-13882/"
            },
            {
              "name": "FEDORA-2020-f251753b0f",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDCHEKNR3HPJRNHE5PYKFH5GNBADTPA7/"
            },
            {
              "name": "FEDORA-2020-059e1591d6",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBFHIX6RTHCK37FXMAAXP4KGAMLUFDUD/"
            },
            {
              "name": "https://cwe.mitre.org/data/definitions/367.html",
              "refsource": "MISC",
              "url": "https://cwe.mitre.org/data/definitions/367.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-13882",
    "datePublished": "2020-06-18T17:35:35.000Z",
    "dateReserved": "2020-06-06T00:00:00.000Z",
    "dateUpdated": "2024-08-04T12:32:14.209Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2020-13882",
      "date": "2026-10-18",
      "epss": "0.00256",
      "percentile": "0.16063"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:cisofy:lynis:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "86CB7140-26C0-428D-A78D-4B12F6692223",
                  "versionEndExcluding": "3.0.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
                  "matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
                  "matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to check the log and report file permissions was not working as intended and could be bypassed locally. Because of the race, an unprivileged attacker can set up a log and report file, and control that up to the point where the specific routine is doing its check. After that, the file can be removed, recreated, and used for additional attacks."
        },
        {
          "lang": "es",
          "value": "CISOfy Lynis versiones anteriores a 3.0.0,  presenta un Control de Acceso Incorrecto debido a una condici\u00f3n de carrera TOCTOU. La rutina para comprobar los permisos del archivo de registro e informe no funcionaba seg\u00fan lo previsto y pod\u00eda ser omitida localmente. Debido a la carrera, un atacante no privilegiado puede configurar un archivo de registro e informe, y controlarlo hasta el punto en que la rutina espec\u00edfica est\u00e9 haciendo su comprobaci\u00f3n. Despu\u00e9s de eso, el archivo puede ser eliminado, creado nuevamente y usado para ataques adicionales"
        }
      ],
      "id": "CVE-2020-13882",
      "lastModified": "2024-11-21T05:02:04.157",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "LOW",
            "cvssData": {
              "accessComplexity": "HIGH",
              "accessVector": "LOCAL",
              "authentication": "NONE",
              "availabilityImpact": "PARTIAL",
              "baseScore": 3.7,
              "confidentialityImpact": "PARTIAL",
              "integrityImpact": "PARTIAL",
              "vectorString": "AV:L/AC:H/Au:N/C:P/I:P/A:P",
              "version": "2.0"
            },
            "exploitabilityScore": 1.9,
            "impactScore": 6.4,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": true
          }
        ],
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "LOW",
              "baseScore": 4.2,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L",
              "version": "3.1"
            },
            "exploitabilityScore": 0.8,
            "impactScore": 3.4,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2020-06-18T18:15:10.967",
      "references": [
        {
          "source": "cve@mitre.org",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://cisofy.com/security/cve/cve-2020-13882/"
        },
        {
          "source": "cve@mitre.org",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://cwe.mitre.org/data/definitions/367.html"
        },
        {
          "source": "cve@mitre.org",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDCHEKNR3HPJRNHE5PYKFH5GNBADTPA7/"
        },
        {
          "source": "cve@mitre.org",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBFHIX6RTHCK37FXMAAXP4KGAMLUFDUD/"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://cisofy.com/security/cve/cve-2020-13882/"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://cwe.mitre.org/data/definitions/367.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDCHEKNR3HPJRNHE5PYKFH5GNBADTPA7/"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBFHIX6RTHCK37FXMAAXP4KGAMLUFDUD/"
        }
      ],
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-367"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:cisofy:lynis:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "86CB7140-26C0-428D-A78D-4B12F6692223",
                    "versionEndExcluding": "3.0.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
                    "matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
                    "matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to check the log and report file permissions was not working as intended and could be bypassed locally. Because of the race, an unprivileged attacker can set up a log and report file, and control that up to the point where the specific routine is doing its check. After that, the file can be removed, recreated, and used for additional attacks."
          },
          {
            "lang": "es",
            "value": "CISOfy Lynis versiones anteriores a 3.0.0,  presenta un Control de Acceso Incorrecto debido a una condici\u00f3n de carrera TOCTOU. La rutina para comprobar los permisos del archivo de registro e informe no funcionaba seg\u00fan lo previsto y pod\u00eda ser omitida localmente. Debido a la carrera, un atacante no privilegiado puede configurar un archivo de registro e informe, y controlarlo hasta el punto en que la rutina espec\u00edfica est\u00e9 haciendo su comprobaci\u00f3n. Despu\u00e9s de eso, el archivo puede ser eliminado, creado nuevamente y usado para ataques adicionales"
          }
        ],
        "id": "CVE-2020-13882",
        "lastModified": "2024-11-21T05:02:04.157",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "LOW",
              "cvssData": {
                "accessComplexity": "HIGH",
                "accessVector": "LOCAL",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 3.7,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:L/AC:H/Au:N/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 1.9,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": true
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "LOCAL",
                "availabilityImpact": "LOW",
                "baseScore": 4.2,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 0.8,
              "impactScore": 3.4,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2020-06-18T18:15:10.967",
        "references": [
          {
            "source": "cve@mitre.org",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://cisofy.com/security/cve/cve-2020-13882/"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://cwe.mitre.org/data/definitions/367.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDCHEKNR3HPJRNHE5PYKFH5GNBADTPA7/"
          },
          {
            "source": "cve@mitre.org",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBFHIX6RTHCK37FXMAAXP4KGAMLUFDUD/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://cisofy.com/security/cve/cve-2020-13882/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://cwe.mitre.org/data/definitions/367.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDCHEKNR3HPJRNHE5PYKFH5GNBADTPA7/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBFHIX6RTHCK37FXMAAXP4KGAMLUFDUD/"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-367"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-11-21T17:02:50+00:00",
      "cve": "CVE-2020-13882",
      "id": "CVE-2020-13882",
      "initial_release_date": "2020-06-18T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "lynis: incorrect access control because of a TOCTOU race condition",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-13882.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2025-03-15T09:57:34Z",
      "cve": "CVE-2020-13882",
      "id": "CVE-2020-13882",
      "initial_release_date": "2023-02-15T03:58:12Z",
      "product_status:recommended": "1",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2020-13882",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2020-13882.json",
      "version": "6"
    }
  }
}

CNVD-2021-19414

Vulnerability from cnvd - Published: 2021-03-19

Title

CISOfy Lynis竞争条件问题漏洞

Description

CISOfy Lynis是荷兰CISOfy公司的一款支持多个平台的系统安全审核工具。 CISOfy Lynis 3.0.0之前版本中存在竞争条件问题漏洞。攻击者可利用该漏洞绕过符号链接检查，在日志和报告中操作数据，进而造成拒绝服务，检索系统信息或提升权限。

Severity

低

Patch Name

CISOfy Lynis竞争条件问题漏洞的补丁

Patch Description

CISOfy Lynis是荷兰CISOfy公司的一款支持多个平台的系统安全审核工具。 CISOfy Lynis 3.0.0之前版本中存在竞争条件问题漏洞。攻击者可利用该漏洞绕过符号链接检查，在日志和报告中操作数据，进而造成拒绝服务，检索系统信息或提升权限。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://cisofy.com/security/cve/cve-2020-13882/

Impacted products

Name
CISOfy Lynis <3.0.0

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-13882"
    }
  },
  "description": "CISOfy Lynis\u662f\u8377\u5170CISOfy\u516c\u53f8\u7684\u4e00\u6b3e\u652f\u6301\u591a\u4e2a\u5e73\u53f0\u7684\u7cfb\u7edf\u5b89\u5168\u5ba1\u6838\u5de5\u5177\u3002\n\nCISOfy Lynis 3.0.0\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u7ade\u4e89\u6761\u4ef6\u95ee\u9898\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7\u7b26\u53f7\u94fe\u63a5\u68c0\u67e5\uff0c\u5728\u65e5\u5fd7\u548c\u62a5\u544a\u4e2d\u64cd\u4f5c\u6570\u636e\uff0c\u8fdb\u800c\u9020\u6210\u62d2\u7edd\u670d\u52a1\uff0c\u68c0\u7d22\u7cfb\u7edf\u4fe1\u606f\u6216\u63d0\u5347\u6743\u9650\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://cisofy.com/security/cve/cve-2020-13882/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-19414",
  "openTime": "2021-03-19",
  "patchDescription": "CISOfy Lynis\u662f\u8377\u5170CISOfy\u516c\u53f8\u7684\u4e00\u6b3e\u652f\u6301\u591a\u4e2a\u5e73\u53f0\u7684\u7cfb\u7edf\u5b89\u5168\u5ba1\u6838\u5de5\u5177\u3002\r\n\r\nCISOfy Lynis 3.0.0\u4e4b\u524d\u7248\u672c\u4e2d\u5b58\u5728\u7ade\u4e89\u6761\u4ef6\u95ee\u9898\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7\u7b26\u53f7\u94fe\u63a5\u68c0\u67e5\uff0c\u5728\u65e5\u5fd7\u548c\u62a5\u544a\u4e2d\u64cd\u4f5c\u6570\u636e\uff0c\u8fdb\u800c\u9020\u6210\u62d2\u7edd\u670d\u52a1\uff0c\u68c0\u7d22\u7cfb\u7edf\u4fe1\u606f\u6216\u63d0\u5347\u6743\u9650\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "CISOfy Lynis\u7ade\u4e89\u6761\u4ef6\u95ee\u9898\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "CISOfy Lynis \u003c3.0.0"
  },
  "serverity": "\u4f4e",
  "submitTime": "2020-06-19",
  "title": "CISOfy Lynis\u7ade\u4e89\u6761\u4ef6\u95ee\u9898\u6f0f\u6d1e"
}

FKIE_CVE-2020-13882

Vulnerability from fkie_nvd - Published: 2020-06-18 18:15 - Updated: 2026-06-17 02:53

Severity

4.2 (Medium) - CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

Summary

References

URL	Tags
cve@mitre.org	https://cisofy.com/security/cve/cve-2020-13882/	Vendor Advisory
cve@mitre.org	https://cwe.mitre.org/data/definitions/367.html	Third Party Advisory
cve@mitre.org	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDCHEKNR3HPJRNHE5PYKFH5GNBADTPA7/
cve@mitre.org	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBFHIX6RTHCK37FXMAAXP4KGAMLUFDUD/
af854a3a-2127-422b-91ae-364da2661108	https://cisofy.com/security/cve/cve-2020-13882/	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://cwe.mitre.org/data/definitions/367.html	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDCHEKNR3HPJRNHE5PYKFH5GNBADTPA7/
af854a3a-2127-422b-91ae-364da2661108	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBFHIX6RTHCK37FXMAAXP4KGAMLUFDUD/

Impacted products

Vendor	Product	Version
cisofy	lynis	*
fedoraproject	fedora	31
fedoraproject	fedora	32

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisofy:lynis:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "86CB7140-26C0-428D-A78D-4B12F6692223",
              "versionEndExcluding": "3.0.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
              "matchCriteriaId": "80F0FA5D-8D3B-4C0E-81E2-87998286AF33",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
              "matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to check the log and report file permissions was not working as intended and could be bypassed locally. Because of the race, an unprivileged attacker can set up a log and report file, and control that up to the point where the specific routine is doing its check. After that, the file can be removed, recreated, and used for additional attacks."
    },
    {
      "lang": "es",
      "value": "CISOfy Lynis versiones anteriores a 3.0.0,  presenta un Control de Acceso Incorrecto debido a una condici\u00f3n de carrera TOCTOU. La rutina para comprobar los permisos del archivo de registro e informe no funcionaba seg\u00fan lo previsto y pod\u00eda ser omitida localmente. Debido a la carrera, un atacante no privilegiado puede configurar un archivo de registro e informe, y controlarlo hasta el punto en que la rutina espec\u00edfica est\u00e9 haciendo su comprobaci\u00f3n. Despu\u00e9s de eso, el archivo puede ser eliminado, creado nuevamente y usado para ataques adicionales"
    }
  ],
  "id": "CVE-2020-13882",
  "lastModified": "2026-06-17T02:53:49.857",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "LOW",
        "cvssData": {
          "accessComplexity": "HIGH",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 3.7,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:L/AC:H/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 1.9,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 4.2,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 0.8,
        "impactScore": 3.4,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-06-18T18:15:10.967",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://cisofy.com/security/cve/cve-2020-13882/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://cwe.mitre.org/data/definitions/367.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDCHEKNR3HPJRNHE5PYKFH5GNBADTPA7/"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBFHIX6RTHCK37FXMAAXP4KGAMLUFDUD/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://cisofy.com/security/cve/cve-2020-13882/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://cwe.mitre.org/data/definitions/367.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JDCHEKNR3HPJRNHE5PYKFH5GNBADTPA7/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UBFHIX6RTHCK37FXMAAXP4KGAMLUFDUD/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-367"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-FGC5-QJVV-CFFV

Vulnerability from github – Published: 2022-05-24 17:20 – Updated: 2022-07-11 00:00

Details

Severity

4.2 (Medium)


                  
                    CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2020-13882"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-367"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2020-06-18T18:15:00Z",
    "severity": "LOW"
  },
  "details": "CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to check the log and report file permissions was not working as intended and could be bypassed locally. Because of the race, an unprivileged attacker can set up a log and report file, and control that up to the point where the specific routine is doing its check. After that, the file can be removed, recreated, and used for additional attacks.",
  "id": "GHSA-fgc5-qjvv-cffv",
  "modified": "2022-07-11T00:00:24Z",
  "published": "2022-05-24T17:20:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-13882"
    },
    {
      "type": "WEB",
      "url": "https://cisofy.com/security/cve/cve-2020-13882"
    },
    {
      "type": "WEB",
      "url": "https://cwe.mitre.org/data/definitions/367.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDCHEKNR3HPJRNHE5PYKFH5GNBADTPA7"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBFHIX6RTHCK37FXMAAXP4KGAMLUFDUD"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2020-13882

Vulnerability from gsd - Updated: 2023-12-13 01:21

Details

Aliases

CVE-2020-13882

Aliases

CVE-2020-13882

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2020-13882",
    "description": "CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to check the log and report file permissions was not working as intended and could be bypassed locally. Because of the race, an unprivileged attacker can set up a log and report file, and control that up to the point where the specific routine is doing its check. After that, the file can be removed, recreated, and used for additional attacks.",
    "id": "GSD-2020-13882",
    "references": [
      "https://www.suse.com/security/cve/CVE-2020-13882.html",
      "https://alas.aws.amazon.com/cve/html/CVE-2020-13882.html"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2020-13882"
      ],
      "details": "CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to check the log and report file permissions was not working as intended and could be bypassed locally. Because of the race, an unprivileged attacker can set up a log and report file, and control that up to the point where the specific routine is doing its check. After that, the file can be removed, recreated, and used for additional attacks.",
      "id": "GSD-2020-13882",
      "modified": "2023-12-13T01:21:46.851326Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2020-13882",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to check the log and report file permissions was not working as intended and could be bypassed locally. Because of the race, an unprivileged attacker can set up a log and report file, and control that up to the point where the specific routine is doing its check. After that, the file can be removed, recreated, and used for additional attacks."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://cisofy.com/security/cve/cve-2020-13882/",
            "refsource": "CONFIRM",
            "url": "https://cisofy.com/security/cve/cve-2020-13882/"
          },
          {
            "name": "FEDORA-2020-f251753b0f",
            "refsource": "FEDORA",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDCHEKNR3HPJRNHE5PYKFH5GNBADTPA7/"
          },
          {
            "name": "FEDORA-2020-059e1591d6",
            "refsource": "FEDORA",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBFHIX6RTHCK37FXMAAXP4KGAMLUFDUD/"
          },
          {
            "name": "https://cwe.mitre.org/data/definitions/367.html",
            "refsource": "MISC",
            "url": "https://cwe.mitre.org/data/definitions/367.html"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:cisofy:lynis:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "3.0.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-13882"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to check the log and report file permissions was not working as intended and could be bypassed locally. Because of the race, an unprivileged attacker can set up a log and report file, and control that up to the point where the specific routine is doing its check. After that, the file can be removed, recreated, and used for additional attacks."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-367"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://cisofy.com/security/cve/cve-2020-13882/",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "https://cisofy.com/security/cve/cve-2020-13882/"
            },
            {
              "name": "FEDORA-2020-f251753b0f",
              "refsource": "FEDORA",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDCHEKNR3HPJRNHE5PYKFH5GNBADTPA7/"
            },
            {
              "name": "FEDORA-2020-059e1591d6",
              "refsource": "FEDORA",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UBFHIX6RTHCK37FXMAAXP4KGAMLUFDUD/"
            },
            {
              "name": "https://cwe.mitre.org/data/definitions/367.html",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://cwe.mitre.org/data/definitions/367.html"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "HIGH",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 3.7,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:L/AC:H/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 1.9,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "LOW",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4.2,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "exploitabilityScore": 0.8,
          "impactScore": 3.4
        }
      },
      "lastModifiedDate": "2022-11-07T13:37Z",
      "publishedDate": "2020-06-18T18:15Z"
    }
  }
}

OPENSUSE-SU-2024:11032-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2026-09-20 20:10

Summary

lynis-3.0.5-3.2 on GA media

Severity

Moderate

Scope

3 vulnerabilities in this advisory, including CVE-2020-13882.

CVE-2020-13882

4.2 (Medium)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

Recommended: 4 products

Open the full advisory

UBUNTU-CVE-2020-13882 (CVE-2020-13882)

Vulnerability from osv_ubuntu – Published: 2020-06-18 18:15 – Updated: 2025-10-24 04:48 – Source website

Details

Severity

4.2 (Medium)


                    
                      CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2020-13882	REPORT
	https://github.com/CISOfy/lynis/pull/594	REPORT
	https://github.com/CISOfy/lynis/commit/5b09da0d98…	REPORT
	https://cisofy.com/security/cve/cve-2020-13882/	REPORT
	https://www.cve.org/CVERecord?id=CVE-2020-13882	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "lynis",
            "binary_version": "2.1.1-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "lynis",
        "purl": "pkg:deb/ubuntu/lynis@2.1.1-1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.1.1-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "lynis",
            "binary_version": "2.6.2-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "lynis",
        "purl": "pkg:deb/ubuntu/lynis@2.6.2-1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.5.0-1",
        "2.6.0-1",
        "2.6.2-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "lynis",
            "binary_version": "2.6.2-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "lynis",
        "purl": "pkg:deb/ubuntu/lynis@2.6.2-1?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.6.2-1"
      ]
    }
  ],
  "aliases": [],
  "details": "CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to check the log and report file permissions was not working as intended and could be bypassed locally. Because of the race, an unprivileged attacker can set up a log and report file, and control that up to the point where the specific routine is doing its check. After that, the file can be removed, recreated, and used for additional attacks.",
  "id": "UBUNTU-CVE-2020-13882",
  "modified": "2025-10-24T04:48:31Z",
  "published": "2020-06-18T18:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2020-13882"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/CISOfy/lynis/pull/594"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/CISOfy/lynis/commit/5b09da0d9878096d45f04b858c4f65e674369ab4"
    },
    {
      "type": "REPORT",
      "url": "https://cisofy.com/security/cve/cve-2020-13882/"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-13882"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2020-13882"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2020-13882 (GCVE-0-2020-13882)

CNVD-2021-19414

FKIE_CVE-2020-13882

GHSA-FGC5-QJVV-CFFV

GSD-2020-13882

OPENSUSE-SU-2024:11032-1

UBUNTU-CVE-2020-13882 (CVE-2020-13882)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour