CVE-2020-25720

Nov. 18, 2024, 5:11 p.m.

7.5
High

Description

A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator owns the object due to the lack of an Access Control List (ACL) at the time of creation and later being recognized as the 'creator owner.' The retained significant rights of the delegated administrator may not be well understood, potentially leading to unintended privilege escalation or security risks.

Product(s) Impacted

Product Versions
Samba

Weaknesses

CWE-264
None
None

References

https://access.redhat.com/security/cve/CVE-2020-25720
https://bugzilla.redhat.com/show_bug.cgi?id=2305954

Tags

secalert@redhat.com
CWE-264
2024-11-17
CVE-2020-25720

CVSS Score

7.5 / 10

CVSS Data

  • Attack Vector: NETWORK
  • Attack Complexity: HIGH
  • Privileges Required: LOW
  • Scope: UNCHANGED
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: HIGH
    • View Vector String

    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Date

  • Published: Nov. 17, 2024, 11:15 a.m.
  • Last Modified: Nov. 18, 2024, 5:11 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

secalert@redhat.com

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.