VDB

CVE-2020-14342

CVE-2020-14342 PUBLISHED CVSS 4.400000095367432 MEDIUM

It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.

EPSS 0.65% · 49.3th percentile

Risk Scores

CVSS 3.1
4.400000095367432
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
EPSS Score
0.65%
49.3th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:16.04:LTScifs-utils2:6.4-1ubuntu1, 0, 2:6.4-1ubuntu1.1
Ubuntu:Pro:14.04:LTScifs-utils2:6.0-1ubuntu2, 0
Ubuntu:18.04:LTScifs-utils2:6.8-1ubuntu1, 0, 2:6.7-1
Ubuntu:20.04:LTScifs-utils2:6.9-0ubuntu1, 0, 2:6.9-1ubuntu0.1

Timeline

  • Sep 9, 2020 CVE Published
  • Apr 14, 2021 EPSS Score
  • Jun 23, 2021 EPSS Score
  • Aug 25, 2021 EPSS Score
  • Dec 30, 2021 EPSS Score
  • Jan 6, 2022 EPSS Score
  • Feb 4, 2022 EPSS Score
  • Mar 3, 2022 EPSS Score
  • Apr 1, 2022 EPSS Score
  • May 5, 2022 EPSS Score
  • Sep 9, 2022 EPSS Score
  • Nov 11, 2022 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›