CVE-2020-3812: canonical ubuntu_linux Improper Privilege Management

Vulnerability summary

CVE-2020-3812 is a medium (CVSS 5.5) Improper Privilege Management vulnerability in canonical ubuntu_linux. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 35.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 26-05-2020
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

qmail-verify as used in netqmail 1.06 is prone to an information disclosure vulnerability. A local attacker can test for the existence of files and directories anywhere in the filesystem because qmail-verify runs as root and tests for the existence of files in the attacker's home directory, without dropping its privileges first.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.