7.8

CVE-2020-14004: icinga Link Following

CVSS: 7.8v3.1HighModified
AliasesopenSUSE-SU-2020:1820-1UBUNTU-CVE-2020-14004DEBIAN-CVE-2020-14004
Published 12-06-2020Last modified 04-08-2024
Open JSON

Vulnerability summary

CVE-2020-14004 is a high (CVSS 7.8) Link Following vulnerability in icinga. EPSS estimates a 0.74% chance of exploitation in the next 30 days, higher than 53.7% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
41/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (NVD)
EPSS score
0.74%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 2 · Related 2
OPENSUSE-SU-2024:10856-1SUSE-SU-2022:3725-1

Timeline

  1. 12-06-2020
    PublishedVulnerability first disclosed.
  2. 04-08-2024
    Last modifiedVulnerability information updated.

Description

An issue was discovered in Icinga2 before v2.12.0-rc1. The prepare-dirs script (run as part of the icinga2 systemd service) executes chmod 2750 /run/icinga2/cmd. /run/icinga2 is under control of an unprivileged user by default. If /run/icinga2/cmd is a symlink, then it will by followed and arbitrary files can be changed to mode 2750 by the unprivileged icinga2 user.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

0.74%

Chance of exploitation in the next 30 days

Percentile

54%

Versus all other CVEs

30-day change

0.00 pp

From 0.74% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.74%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (openwall.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Opensuse4 products
  • backports_sle15.0:sp1 | 15.0:sp2
  • leapEOL15.1 | 15.2
  • icinga2&distro=openSUSE Leap 15.1< 2.12.1-bp152.4.3.1
  • icinga2&distro=openSUSE Leap 15.2< 2.12.1-bp152.4.3.1
Suse2 products
  • icinga2&distro=SUSE Package Hub 15 SP1< 2.12.1-bp152.4.3.1
  • icinga2&distro=SUSE Package Hub 15 SP2< 2.12.1-bp152.4.3.1
Debian1 product
  • icinga2< 2.11.5-1
Icinga1 product
  • icingaEOL≥ 2.0.0, ≤ 2.11.3 | 2.12.0:rc1
Ubuntu1 product
  • icinga2All versions (No fix recorded)

5 vendors · 9 products

References

17 links
Show all 17 references