GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2020-8023 (GCVE-0-2020-8023)

Vulnerability from cvelistv5 – Published: 2020-09-01 11:25 – Updated: 2024-09-16 18:33
VLAI
Title
Local privilege escalation from ldap to root when using OPENLDAP_CONFIG_BACKEND=ldap in openldap2
Summary
A acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the start script of openldap2 of SUSE Enterprise Storage 5, SUSE Linux Enterprise Debuginfo 11-SP3, SUSE Linux Enterprise Debuginfo 11-SP4, SUSE Linux Enterprise Point of Sale 11-SP3, SUSE Linux Enterprise Server 11-SECURITY, SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8; openSUSE Leap 15.1, openSUSE Leap 15.2 allows local attackers to escalate privileges from user ldap to root. This issue affects: SUSE Enterprise Storage 5 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Debuginfo 11-SP3 openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Debuginfo 11-SP4 openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Point of Sale 11-SP3 openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Server 11-SECURITY openldap2-client-openssl1 versions prior to 2.4.26-0.74.13.1. SUSE Linux Enterprise Server 11-SP4-LTSS openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Server 12-SP2-BCL openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP2-LTSS openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP3-BCL openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP3-LTSS openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP4 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP5 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 15-LTSS openldap2 versions prior to 2.4.46-9.31.1. SUSE Linux Enterprise Server for SAP 12-SP2 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server for SAP 12-SP3 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server for SAP 15 openldap2 versions prior to 2.4.46-9.31.1. SUSE OpenStack Cloud 7 openldap2 versions prior to 2.4.41-18.71.2. SUSE OpenStack Cloud 8 openldap2 versions prior to 2.4.41-18.71.2. SUSE OpenStack Cloud Crowbar 8 openldap2 versions prior to 2.4.41-18.71.2. openSUSE Leap 15.1 openldap2 versions prior to 2.4.46-lp151.10.12.1. openSUSE Leap 15.2 openldap2 versions prior to 2.4.46-lp152.14.3.1.
Severity
7.7 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE
  • CWE-349 - Acceptance of Extraneous Untrusted Data With Trusted Data
Assigner
References
Impacted products
Vendor Product Version CPE status
SUSE SUSE Enterprise Storage 5 Affected: openldap2 , < 2.4.41-18.71.2 (custom)
guessed Create a notification for this product.
SUSE SUSE Linux Enterprise Debuginfo 11-SP3 Affected: openldap2 , < 2.4.26-0.74.13.1, (custom)
guessed Create a notification for this product.
SUSE SUSE Linux Enterprise Debuginfo 11-SP4 Affected: openldap2 , < 2.4.26-0.74.13.1, (custom)
guessed Create a notification for this product.
SUSE SUSE Linux Enterprise Point of Sale 11-SP3 Affected: openldap2 , < 2.4.26-0.74.13.1, (custom)
guessed Create a notification for this product.
SUSE SUSE Linux Enterprise Server 11-SECURITY Affected: openldap2-client-openssl1 , < 2.4.26-0.74.13.1 (custom)
guessed Create a notification for this product.
SUSE SUSE Linux Enterprise Server 11-SP4-LTSS Affected: openldap2 , < 2.4.26-0.74.13.1, (custom)
guessed Create a notification for this product.
SUSE SUSE Linux Enterprise Server 12-SP2-BCL Affected: openldap2 , < 2.4.41-18.71.2 (custom)
guessed Create a notification for this product.
SUSE SUSE Linux Enterprise Server 12-SP2-LTSS Affected: openldap2 , < 2.4.41-18.71.2 (custom)
guessed Create a notification for this product.
SUSE SUSE Linux Enterprise Server 12-SP3-BCL Affected: openldap2 , < 2.4.41-18.71.2 (custom)
guessed Create a notification for this product.
SUSE SUSE Linux Enterprise Server 12-SP3-LTSS Affected: openldap2 , < 2.4.41-18.71.2 (custom)
guessed Create a notification for this product.
SUSE SUSE Linux Enterprise Server 12-SP4 Affected: openldap2 , < 2.4.41-18.71.2 (custom)
guessed Create a notification for this product.
SUSE SUSE Linux Enterprise Server 12-SP5 Affected: openldap2 , < 2.4.41-18.71.2 (custom)
guessed Create a notification for this product.
SUSE SUSE Linux Enterprise Server 15-LTSS Affected: openldap2 , < 2.4.46-9.31.1 (custom)
guessed Create a notification for this product.
SUSE SUSE Linux Enterprise Server for SAP 12-SP2 Affected: openldap2 , < 2.4.41-18.71.2 (custom)
guessed Create a notification for this product.
SUSE SUSE Linux Enterprise Server for SAP 12-SP3 Affected: openldap2 , < 2.4.41-18.71.2 (custom)
guessed Create a notification for this product.
SUSE SUSE Linux Enterprise Server for SAP 15 Affected: openldap2 , < 2.4.46-9.31.1 (custom)
guessed Create a notification for this product.
SUSE SUSE OpenStack Cloud 7 Affected: openldap2 , < 2.4.41-18.71.2 (custom)
guessed Create a notification for this product.
SUSE SUSE OpenStack Cloud 8 Affected: openldap2 , < 2.4.41-18.71.2 (custom)
guessed Create a notification for this product.
SUSE SUSE OpenStack Cloud Crowbar 8 Affected: openldap2 , < 2.4.41-18.71.2 (custom)
guessed Create a notification for this product.
openSUSE openSUSE Leap 15.1 Affected: openldap2 , < 2.4.46-lp151.10.12.1 (custom)
guessed Create a notification for this product.
openSUSE openSUSE Leap 15.2 Affected: openldap2 , < 2.4.46-lp152.14.3.1 (custom)
guessed Create a notification for this product.
Date Public
2020-07-06 00:00
Credits
Johannes Segitz of SUSE
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T09:48:25.193Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=1172698"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SUSE Enterprise Storage 5",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "2.4.41-18.71.2",
              "status": "affected",
              "version": "openldap2",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "SUSE Linux Enterprise Debuginfo 11-SP3",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "2.4.26-0.74.13.1,",
              "status": "affected",
              "version": "openldap2",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "SUSE Linux Enterprise Debuginfo 11-SP4",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "2.4.26-0.74.13.1,",
              "status": "affected",
              "version": "openldap2",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "SUSE Linux Enterprise Point of Sale 11-SP3",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "2.4.26-0.74.13.1,",
              "status": "affected",
              "version": "openldap2",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "SUSE Linux Enterprise Server 11-SECURITY",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "2.4.26-0.74.13.1",
              "status": "affected",
              "version": "openldap2-client-openssl1",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "SUSE Linux Enterprise Server 11-SP4-LTSS",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "2.4.26-0.74.13.1,",
              "status": "affected",
              "version": "openldap2",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "SUSE Linux Enterprise Server 12-SP2-BCL",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "2.4.41-18.71.2",
              "status": "affected",
              "version": "openldap2",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "SUSE Linux Enterprise Server 12-SP2-LTSS",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "2.4.41-18.71.2",
              "status": "affected",
              "version": "openldap2",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "SUSE Linux Enterprise Server 12-SP3-BCL",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "2.4.41-18.71.2",
              "status": "affected",
              "version": "openldap2",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "SUSE Linux Enterprise Server 12-SP3-LTSS",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "2.4.41-18.71.2",
              "status": "affected",
              "version": "openldap2",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "SUSE Linux Enterprise Server 12-SP4",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "2.4.41-18.71.2",
              "status": "affected",
              "version": "openldap2",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "SUSE Linux Enterprise Server 12-SP5",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "2.4.41-18.71.2",
              "status": "affected",
              "version": "openldap2",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "SUSE Linux Enterprise Server 15-LTSS",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "2.4.46-9.31.1",
              "status": "affected",
              "version": "openldap2",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "SUSE Linux Enterprise Server for SAP 12-SP2",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "2.4.41-18.71.2",
              "status": "affected",
              "version": "openldap2",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "SUSE Linux Enterprise Server for SAP 12-SP3",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "2.4.41-18.71.2",
              "status": "affected",
              "version": "openldap2",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "SUSE Linux Enterprise Server for SAP 15",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "2.4.46-9.31.1",
              "status": "affected",
              "version": "openldap2",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "SUSE OpenStack Cloud 7",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "2.4.41-18.71.2",
              "status": "affected",
              "version": "openldap2",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "SUSE OpenStack Cloud 8",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "2.4.41-18.71.2",
              "status": "affected",
              "version": "openldap2",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "SUSE OpenStack Cloud Crowbar 8",
          "vendor": "SUSE",
          "versions": [
            {
              "lessThan": "2.4.41-18.71.2",
              "status": "affected",
              "version": "openldap2",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "openSUSE Leap 15.1",
          "vendor": "openSUSE",
          "versions": [
            {
              "lessThan": "2.4.46-lp151.10.12.1",
              "status": "affected",
              "version": "openldap2",
              "versionType": "custom"
            }
          ]
        },
        {
          "product": "openSUSE Leap 15.2",
          "vendor": "openSUSE",
          "versions": [
            {
              "lessThan": "2.4.46-lp152.14.3.1",
              "status": "affected",
              "version": "openldap2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Johannes Segitz of SUSE"
        }
      ],
      "datePublic": "2020-07-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the start script of openldap2 of SUSE Enterprise Storage 5, SUSE Linux Enterprise Debuginfo 11-SP3, SUSE Linux Enterprise Debuginfo 11-SP4, SUSE Linux Enterprise Point of Sale 11-SP3, SUSE Linux Enterprise Server 11-SECURITY, SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8; openSUSE Leap 15.1, openSUSE Leap 15.2 allows local attackers to escalate privileges from user ldap to root. This issue affects: SUSE Enterprise Storage 5 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Debuginfo 11-SP3 openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Debuginfo 11-SP4 openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Point of Sale 11-SP3 openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Server 11-SECURITY openldap2-client-openssl1 versions prior to 2.4.26-0.74.13.1. SUSE Linux Enterprise Server 11-SP4-LTSS openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Server 12-SP2-BCL openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP2-LTSS openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP3-BCL openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP3-LTSS openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP4 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP5 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 15-LTSS openldap2 versions prior to 2.4.46-9.31.1. SUSE Linux Enterprise Server for SAP 12-SP2 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server for SAP 12-SP3 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server for SAP 15 openldap2 versions prior to 2.4.46-9.31.1. SUSE OpenStack Cloud 7 openldap2 versions prior to 2.4.41-18.71.2. SUSE OpenStack Cloud 8 openldap2 versions prior to 2.4.41-18.71.2. SUSE OpenStack Cloud Crowbar 8 openldap2 versions prior to 2.4.41-18.71.2. openSUSE Leap 15.1 openldap2 versions prior to 2.4.46-lp151.10.12.1. openSUSE Leap 15.2 openldap2 versions prior to 2.4.46-lp152.14.3.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-349",
              "description": "CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-09-01T11:25:12.000Z",
        "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
        "shortName": "suse"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.suse.com/show_bug.cgi?id=1172698"
        }
      ],
      "source": {
        "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1172698",
        "defect": [
          "1172698"
        ],
        "discovery": "INTERNAL"
      },
      "title": "Local privilege escalation from ldap to root when using OPENLDAP_CONFIG_BACKEND=ldap in openldap2",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@suse.com",
          "DATE_PUBLIC": "2020-07-06T00:00:00.000Z",
          "ID": "CVE-2020-8023",
          "STATE": "PUBLIC",
          "TITLE": "Local privilege escalation from ldap to root when using OPENLDAP_CONFIG_BACKEND=ldap in openldap2"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SUSE Enterprise Storage 5",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "openldap2",
                            "version_value": "2.4.41-18.71.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SUSE Linux Enterprise Debuginfo 11-SP3",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "openldap2",
                            "version_value": "2.4.26-0.74.13.1,"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SUSE Linux Enterprise Debuginfo 11-SP4",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "openldap2",
                            "version_value": "2.4.26-0.74.13.1,"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SUSE Linux Enterprise Point of Sale 11-SP3",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "openldap2",
                            "version_value": "2.4.26-0.74.13.1,"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SUSE Linux Enterprise Server 11-SECURITY",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "openldap2-client-openssl1",
                            "version_value": "2.4.26-0.74.13.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SUSE Linux Enterprise Server 11-SP4-LTSS",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "openldap2",
                            "version_value": "2.4.26-0.74.13.1,"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SUSE Linux Enterprise Server 12-SP2-BCL",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "openldap2",
                            "version_value": "2.4.41-18.71.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SUSE Linux Enterprise Server 12-SP2-LTSS",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "openldap2",
                            "version_value": "2.4.41-18.71.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SUSE Linux Enterprise Server 12-SP3-BCL",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "openldap2",
                            "version_value": "2.4.41-18.71.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SUSE Linux Enterprise Server 12-SP3-LTSS",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "openldap2",
                            "version_value": "2.4.41-18.71.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SUSE Linux Enterprise Server 12-SP4",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "openldap2",
                            "version_value": "2.4.41-18.71.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SUSE Linux Enterprise Server 12-SP5",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "openldap2",
                            "version_value": "2.4.41-18.71.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SUSE Linux Enterprise Server 15-LTSS",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "openldap2",
                            "version_value": "2.4.46-9.31.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SUSE Linux Enterprise Server for SAP 12-SP2",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "openldap2",
                            "version_value": "2.4.41-18.71.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SUSE Linux Enterprise Server for SAP 12-SP3",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "openldap2",
                            "version_value": "2.4.41-18.71.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SUSE Linux Enterprise Server for SAP 15",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "openldap2",
                            "version_value": "2.4.46-9.31.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SUSE OpenStack Cloud 7",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "openldap2",
                            "version_value": "2.4.41-18.71.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SUSE OpenStack Cloud 8",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "openldap2",
                            "version_value": "2.4.41-18.71.2"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "SUSE OpenStack Cloud Crowbar 8",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "openldap2",
                            "version_value": "2.4.41-18.71.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SUSE"
              },
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "openSUSE Leap 15.1",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "openldap2",
                            "version_value": "2.4.46-lp151.10.12.1"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "openSUSE Leap 15.2",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "openldap2",
                            "version_value": "2.4.46-lp152.14.3.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "openSUSE"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "Johannes Segitz of SUSE"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the start script of openldap2 of SUSE Enterprise Storage 5, SUSE Linux Enterprise Debuginfo 11-SP3, SUSE Linux Enterprise Debuginfo 11-SP4, SUSE Linux Enterprise Point of Sale 11-SP3, SUSE Linux Enterprise Server 11-SECURITY, SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8; openSUSE Leap 15.1, openSUSE Leap 15.2 allows local attackers to escalate privileges from user ldap to root. This issue affects: SUSE Enterprise Storage 5 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Debuginfo 11-SP3 openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Debuginfo 11-SP4 openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Point of Sale 11-SP3 openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Server 11-SECURITY openldap2-client-openssl1 versions prior to 2.4.26-0.74.13.1. SUSE Linux Enterprise Server 11-SP4-LTSS openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Server 12-SP2-BCL openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP2-LTSS openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP3-BCL openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP3-LTSS openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP4 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP5 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 15-LTSS openldap2 versions prior to 2.4.46-9.31.1. SUSE Linux Enterprise Server for SAP 12-SP2 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server for SAP 12-SP3 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server for SAP 15 openldap2 versions prior to 2.4.46-9.31.1. SUSE OpenStack Cloud 7 openldap2 versions prior to 2.4.41-18.71.2. SUSE OpenStack Cloud 8 openldap2 versions prior to 2.4.41-18.71.2. SUSE OpenStack Cloud Crowbar 8 openldap2 versions prior to 2.4.41-18.71.2. openSUSE Leap 15.1 openldap2 versions prior to 2.4.46-lp151.10.12.1. openSUSE Leap 15.2 openldap2 versions prior to 2.4.46-lp152.14.3.1."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.suse.com/show_bug.cgi?id=1172698",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.suse.com/show_bug.cgi?id=1172698"
            }
          ]
        },
        "source": {
          "advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1172698",
          "defect": [
            "1172698"
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb",
    "assignerShortName": "suse",
    "cveId": "CVE-2020-8023",
    "datePublished": "2020-09-01T11:25:12.674Z",
    "dateReserved": "2020-01-27T00:00:00.000Z",
    "dateUpdated": "2024-09-16T18:33:45.008Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2020-8023",
      "date": "2026-09-20",
      "epss": "0.00407",
      "percentile": "0.34723"
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:opensuse:openldap2:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "C4935C06-5C8F-403C-9749-A7734898CF77",
                    "versionEndExcluding": "2.4.41-18.71.2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:suse:enterprise_storage:5.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "CB13FD29-BB94-4B33-870F-7EC956E87515",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:a:suse:openstack_cloud:7.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6A11C023-22C5-409C-9818-2C91D51AE01B",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:a:suse:openstack_cloud:8.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1C3BEB21-4080-4258-B95C-562D717AED0B",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:a:suse:openstack_cloud_crowbar:8.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "1675CBE5-44D3-4326-AE8B-EEB9E25D783A",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:o:suse:linux_enterprise_server:12:sp2:*:*:*:*:*:*",
                    "matchCriteriaId": "F84B2729-7B52-4505-9656-1BD31B980705",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:o:suse:linux_enterprise_server:12:sp2:*:*:*:sap:*:*",
                    "matchCriteriaId": "3691A00A-D075-437B-A818-C7C26EE73532",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:o:suse:linux_enterprise_server:12:sp2:*:*:ltss:*:*:*",
                    "matchCriteriaId": "32C12523-2500-44D0-97EE-E740BD3E61B3",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:o:suse:linux_enterprise_server:12:sp3:*:*:*:sap:*:*",
                    "matchCriteriaId": "16729D9C-DC05-41BD-9B32-682983190CE0",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:o:suse:linux_enterprise_server:12:sp3:*:*:-:-:*:*",
                    "matchCriteriaId": "47FB0003-EFE7-4E9A-8772-27576A771884",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:o:suse:linux_enterprise_server:12:sp3:*:*:ltss:*:*:*",
                    "matchCriteriaId": "C6622CD4-DF4B-4064-BAEB-5E382C4B05C8",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:o:suse:linux_enterprise_server:12:sp4:*:*:*:*:*:*",
                    "matchCriteriaId": "55E8AB88-2347-497B-91DE-AF64E08ED8F3",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:o:suse:linux_enterprise_server:12:sp5:*:*:*:*:*:*",
                    "matchCriteriaId": "29AE5751-3EA5-4056-8E79-16D8DCD248EF",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:opensuse:openldap2:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "82F3AA5B-117D-40C8-906C-10EDB9F4A78F",
                    "versionEndExcluding": "2.4.26-0.74.13.1",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp3:*:*:*:*:*:*",
                    "matchCriteriaId": "58D3B6FD-B474-4B09-B644-A8634A629280",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*",
                    "matchCriteriaId": "F892F1B0-514C-42F7-90AE-12ACDFDC1033",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:a:suse:linux_enterprise_point_of_sale:11:sp3:*:*:*:*:*:*",
                    "matchCriteriaId": "0FC411C9-9A8A-49D0-B704-2207674778CB",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:o:suse:linux_enterprise_server:11:-:*:*:*:*:*:*",
                    "matchCriteriaId": "F13F07CC-739B-465C-9184-0E9D708BD4C7",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:o:suse:linux_enterprise_server:11:sp4:*:*:ltss:*:*:*",
                    "matchCriteriaId": "7B84C8D3-0B59-40DC-881D-D016A422E8CC",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:opensuse:openldap2:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "64EB69D1-17C9-472E-8C74-0B792D230A6B",
                    "versionEndExcluding": "2.4.46-9.31.1",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:ltss:*:*",
                    "matchCriteriaId": "293AC7BE-C913-40A1-AAA5-70BE6F3969EB",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:sap:*:*",
                    "matchCriteriaId": "C665A768-DBDA-4197-9159-A2791E98A84F",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:opensuse:openldap2:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "76E06618-6628-4BC6-91CF-2A7CF92FC764",
                    "versionEndExcluding": "2.4.46-lp151.10.12.1",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              },
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
                    "vulnerable": false
                  },
                  {
                    "criteria": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*",
                    "matchCriteriaId": "B009C22E-30A4-4288-BCF6-C3E81DEAF45A",
                    "vulnerable": false
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ],
            "operator": "AND"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the start script of openldap2 of SUSE Enterprise Storage 5, SUSE Linux Enterprise Debuginfo 11-SP3, SUSE Linux Enterprise Debuginfo 11-SP4, SUSE Linux Enterprise Point of Sale 11-SP3, SUSE Linux Enterprise Server 11-SECURITY, SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8; openSUSE Leap 15.1, openSUSE Leap 15.2 allows local attackers to escalate privileges from user ldap to root. This issue affects: SUSE Enterprise Storage 5 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Debuginfo 11-SP3 openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Debuginfo 11-SP4 openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Point of Sale 11-SP3 openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Server 11-SECURITY openldap2-client-openssl1 versions prior to 2.4.26-0.74.13.1. SUSE Linux Enterprise Server 11-SP4-LTSS openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Server 12-SP2-BCL openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP2-LTSS openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP3-BCL openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP3-LTSS openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP4 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP5 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 15-LTSS openldap2 versions prior to 2.4.46-9.31.1. SUSE Linux Enterprise Server for SAP 12-SP2 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server for SAP 12-SP3 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server for SAP 15 openldap2 versions prior to 2.4.46-9.31.1. SUSE OpenStack Cloud 7 openldap2 versions prior to 2.4.41-18.71.2. SUSE OpenStack Cloud 8 openldap2 versions prior to 2.4.41-18.71.2. SUSE OpenStack Cloud Crowbar 8 openldap2 versions prior to 2.4.41-18.71.2. openSUSE Leap 15.1 openldap2 versions prior to 2.4.46-lp151.10.12.1. openSUSE Leap 15.2 openldap2 versions prior to 2.4.46-lp152.14.3.1."
          },
          {
            "lang": "es",
            "value": "Una vulnerabilidad de  aceptaci\u00f3n de Datos Extra\u00f1os No Confiables con Datos Confiables en el script de inicio de openldap2 de SUSE Enterprise Storage 5, SUSE Linux Enterprise Debuginfo 11-SP3, SUSE Linux Enterprise Debuginfo 11-SP4, SUSE Linux Enterprise Point of Sale 11-SP3, SUSE Linux Enterprise Server 11-SECURITY, SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server para SAP 12-SP2, SUSE Linux Enterprise Server para SAP 12-SP3, SUSE Linux Enterprise Server para SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8;\u0026#xa0;openSUSE Leap 15.1,\u0026#xa0;openSUSE Leap 15.2, permite a atacantes locales escalar los privilegios del usuario de ldap a root.\u0026#xa0;Este problema afecta a: openldap2 de SUSE Enterprise Storage 5 versiones anteriores a 2.4.41-18.71.2.\u0026#xa0;openldap2 de SUSE Linux Enterprise Debuginfo 11-SP3 versiones anteriores a 2.4.26-0.74.13.1,.\u0026#xa0;openldap2 de SUSE Linux Enterprise Debuginfo 11-SP4 versiones anteriores a 2.4.26-0.74.13.1,.\u0026#xa0;openldap2 de SUSE Linux Enterprise Point of Sale 11-SP3 versiones anteriores a 2.4.26-0.74.13.1,.\u0026#xa0;openldap2-client-openssl1 de SUSE Linux Enterprise Server 11-SECURITY versiones anteriores a 2.4.26-0.74.13.1.\u0026#xa0;openldap2 de SUSE Linux Enterprise Server 11-SP4-LTSS versiones anteriores a 2.4.26-0.74.13.1,.\u0026#xa0;openldap2 de SUSE Linux Enterprise Server 12-SP2-BCL versiones anteriores a 2.4.41-18.71.2.\u0026#xa0;openldap2 de SUSE Linux Enterprise Server 12-SP2-LTSS versiones anteriores a 2.4.41-18.71.2.\u0026#xa0;openldap2 de SUSE Linux Enterprise Server 12-SP3-BCL versiones anteriores a 2.4.41-18.71.2.\u0026#xa0;openldap2 de SUSE Linux Enterprise Server 12-SP3-LTSS versiones anteriores a 2.4.41-18.71.2.\u0026#xa0;openldap2 de SUSE Linux Enterprise Server 12-SP4 versiones anteriores a 2.4.41-18.71.2.\u0026#xa0;openldap2 de SUSE Linux Enterprise Server 12-SP5 versiones anteriores a 2.4.41-18.71.2.\u0026#xa0;openldap2 de SUSE Linux Enterprise Server 15-LTSS versiones anteriores a 2.4.46-9.31.1.\u0026#xa0;openldap2 de SUSE Linux Enterprise Server para SAP 12-SP2 versiones anteriores a 2.4.41-18.71.2.\u0026#xa0;openldap2 de SUSE Linux Enterprise Server para SAP 12-SP3 versiones anteriores a 2.4.41-18.71.2.\u0026#xa0;openldap2 de SUSE Linux Enterprise Server para SAP 15 versiones anteriores a 2.4.46-9.31.1.\u0026#xa0;openldap2 de SUSE OpenStack Cloud 7 versiones anteriores a 2.4.41-18.71.2.\u0026#xa0;openldap2 de SUSE OpenStack Cloud 8 versiones anteriores a 2.4.41-18.71.2.\u0026#xa0;openldap2 de SUSE OpenStack Cloud Crowbar 8 versiones anteriores a 2.4.41-18.71.2.\u0026#xa0;openldap2 de openSUSE Leap 15.1 versiones anteriores a 2.4.46-lp151.10.12.1.\u0026#xa0;openldap2 de openSUSE Leap 15.2 versiones anteriores a 2.4.46-lp152.14.3.1"
          }
        ],
        "id": "CVE-2020-8023",
        "lastModified": "2024-11-21T05:38:14.387",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "HIGH",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "LOCAL",
                "authentication": "NONE",
                "availabilityImpact": "COMPLETE",
                "baseScore": 7.2,
                "confidentialityImpact": "COMPLETE",
                "integrityImpact": "COMPLETE",
                "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                "version": "2.0"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 10.0,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "NONE",
                "baseScore": 7.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.5,
              "impactScore": 5.2,
              "source": "meissner@suse.de",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2020-09-01T12:15:10.123",
        "references": [
          {
            "source": "meissner@suse.de",
            "tags": [
              "Exploit",
              "Issue Tracking",
              "Vendor Advisory"
            ],
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=1172698"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Exploit",
              "Issue Tracking",
              "Vendor Advisory"
            ],
            "url": "https://bugzilla.suse.com/show_bug.cgi?id=1172698"
          }
        ],
        "sourceIdentifier": "meissner@suse.de",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-349"
              }
            ],
            "source": "meissner@suse.de",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-02-24T01:27:34+00:00",
      "cve": "CVE-2020-8023",
      "id": "CVE-2020-8023",
      "initial_release_date": "2020-07-06T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Local privilege escalation from ldap to root when using OPENLDAP_CONFIG_BACKEND=ldap in openldap2",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2020/cve-2020-8023.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.