CVE-2020-10699
targetcli: world writable /var/run/targetclid.sock allows unprivileged user to execute commands
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A flaw was found in Linux, in targetcli-fb versions 2.1.50 and 2.1.51 where the socket used by targetclid was world-writable. If a system enables the targetclid socket, a local attacker can use this flaw to modify the iSCSI configuration and escalate their privileges to root.
Se detectó un fallo en Linux, en targetcli-fb versiones 2.1.50 y 2.1.51, donde el socket utilizado por targetclid era de tipo world-writable. Si un sistema habilita el socket targetclid, un atacante local puede usar este fallo para modificar la configuración de iSCSI y escalar sus privilegios a root.
A flaw was found in Linux, where the socket used by targetclid was world-writable. If a system enables the targetclid socket, a local attacker can use this flaw to modify the iSCSI configuration and escalate their privileges to root.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-03-20 CVE Reserved
- 2020-04-15 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-732: Incorrect Permission Assignment for Critical Resource
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| https://github.com/open-iscsi/targetcli-fb/issues/162 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10699 | 2023-11-07 |
| URL | Date | SRC |
|---|---|---|
| https://security.gentoo.org/glsa/202008-22 | 2023-11-07 | |
| https://access.redhat.com/security/cve/CVE-2020-10699 | 2020-04-28 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1819219 | 2020-04-28 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Targetcli-fb Project Search vendor "Targetcli-fb Project" | Targetcli-fb Search vendor "Targetcli-fb Project" for product "Targetcli-fb" | 2.1.50 Search vendor "Targetcli-fb Project" for product "Targetcli-fb" and version "2.1.50" | - |
Affected
| ||||||
| Targetcli-fb Project Search vendor "Targetcli-fb Project" | Targetcli-fb Search vendor "Targetcli-fb Project" for product "Targetcli-fb" | 2.1.51 Search vendor "Targetcli-fb Project" for product "Targetcli-fb" and version "2.1.51" | - |
Affected
| ||||||