CVE-2020-14004 : An issue was discovered in Icinga2 before v2.12.0-rc1. The prepare-dirs script (

An issue was discovered in Icinga2 before v2.12.0-rc1. The prepare-dirs script (run as part of the icinga2 systemd service) executes chmod 2750 /run/icinga2/cmd. /run/icinga2 is under control of an unprivileged user by default. If /run/icinga2/cmd is a symlink, then it will by followed and arbitrary files can be changed to mode 2750 by the unprivileged icinga2 user.

Published 2020-06-12 16:15:10

Updated 2022-11-16 03:43:31

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2020-14004

Opensuse » Leap » Version: 15.1
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
Matching versions
Opensuse » Leap » Version: 15.2
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*
Matching versions
Opensuse » Backports Sle » Version: 15.0 Update SP1
cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*
Matching versions
Opensuse » Backports Sle » Version: 15.0 Update SP2
cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:*
Matching versions
Icinga » Icinga
Versions from including (>=) 2.0.0 and up to, including, (<=) 2.11.3
cpe:2.3:a:icinga:icinga:*:*:*:*:*:*:*:*
Matching versions
Icinga » Icinga » Version: 2.12.0 Update RC1
cpe:2.3:a:icinga:icinga:2.12.0:rc1:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2020-14004

Top countries where our scanners detected CVE-2020-14004

Top open port discovered on systems with this issue 80

IPs affected by CVE-2020-14004 6

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2020-14004!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2020-14004

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 18 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-14004

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.6	MEDIUM	AV:L/AC:L/Au:N/C:P/I:P/A:P	3.9	6.4	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2020-14004

CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-14004

http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00014.html

[security-announce] openSUSE-SU-2020:1820-1: moderate: Security update f
Broken Link;Mailing List;Third Party Advisory
http://www.openwall.com/lists/oss-security/2020/06/12/1

oss-security - icinga2: CVE-2020-14004: prepare-dirs script allows for symlink attack in the icinga user context
Exploit;Mailing List;Third Party Advisory
https://github.com/Icinga/icinga2/compare/v2.12.0-rc1...master

Comparing v2.12.0-rc1...master · Icinga/icinga2 · GitHub
Third Party Advisory
https://github.com/Icinga/icinga2/releases

Releases · Icinga/icinga2 · GitHub
Release Notes;Third Party Advisory
https://github.com/Icinga/icinga2/pull/8045/commits/2f0f2e8c355b75fa4407d23f85feea037d2bc4b6

prepare-dirs: combine mkdir and chmod by Al2Klimov · Pull Request #8045 · Icinga/icinga2 · GitHub
Patch;Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2020-14004

Invalid Bug ID
Broken Link;Issue Tracking