Medium severity · published Dec 3, 2020
CVE-2020-14318
A flaw was found in the way samba handled file and directory permissions
4.3
CVSS
1.5%
EPSS
No
On KEV
Description
A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certain file and directory information which otherwise would be unavailable to the attacker.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Enterprise Linux · Redhat
7.0; 8.0 · source: NVD
SA
Samba · Samba
3.6.0 before 4.11.15; 4.12.0 before 4.12.9; 4.13.0 before 4.13.1 · source: NVD
ST
Storage · Redhat
3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-14318
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-14318
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1892631
lists.debian.org
https://lists.debian.org/debian-lts-announce/2024/04/msg00015.html
Third Party Advisory
https://security.gentoo.org/glsa/202012-24
Vendor Advisory
https://www.samba.org/samba/security/CVE-2020-14318.html
More from Enterprise Linux
9.8
CVE-2019-11043
Underflow in PHP-FPM can lead to RCE
9.8
CVE-2018-14667
The RichFaces Framework 3.X through 3.3.4 is vulnerable to Expression Language (EL) injection via the UserResource resource
9.8
CVE-2014-7169
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
9.8
CVE-2014-6271
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
9.0
CVE-2021-40438
mod_proxy SSRF