CVE-2020-7954

{"id": "CVE-2020-7954", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2020-02-06T17:15:14.600", "references": [{"url": "https://medium.com/%40ph0rensic", "source": "cve@mitre.org"}, {"url": "https://medium.com/%40ph0rensic/three-cves-on-opmon-3ca775a262f5", "source": "cve@mitre.org"}, {"url": "https://medium.com/%40ph0rensic", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://medium.com/%40ph0rensic/three-cves-on-opmon-3ca775a262f5", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-306"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in OpServices OpMon 9.3.2. Starting from the apache user account, it is possible to perform privilege escalation through the lack of correct configuration in the server's sudoers file, which by default allows the execution of programs (e.g. nmap) without the need for a password with sudo."}, {"lang": "es", "value": "Se detect\u00f3 un problema en OpServices OpMon versi\u00f3n 9.3.2. A partir de la cuenta de usuario apache, es posible realizar una escalada de privilegios mediante la falta de configuraci\u00f3n correcta en el archivo sudoers del servidor, que por defecto permite una ejecuci\u00f3n de programas (por ejemplo, nmap) sin la necesidad de una contrase\u00f1a con sudo."}], "lastModified": "2024-11-21T05:38:04.953", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:opservices:opmon:9.3.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E07AF095-7382-430B-BC92-EDE4ED539FCE"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}