7.8

CVE-2020-27985

Exploit
Security Onion v2 prior to 2.3.10 has an incorrect sudo configuration, which allows the administrative user to obtain root access without using the sudo password by editing and executing /home/<user>/SecurityOnion/setup/so-setup.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Securityonionsolutions ≫ Security Onion Version >= 2.0.0 < 2.3.10
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.52% 0.402
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

https://github.com/Security-Onion-Solutions/securityonion/commit/b14670030349a2747a00ace665568ab5f51ac47b
Patch
Third Party Advisory
https://github.com/Security-Onion-Solutions/securityonion/releases
Third Party Advisory
Release Notes
https://s1gh.sh/cve-2020-27985-security-onion-local-privilege-escalation/
Patch
Third Party Advisory
Exploit