CVE-2020-25720
published 2024-11-17CVE-2020-25720: A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the…
PriorityP346high7.5CVSS 3.1
AVNACHPRLUINSUCHIHAH
EPSS
0.48%
38.9th percentile
A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator owns the object due to the lack of an Access Control List (ACL) at the time of creation and later being recognized as the 'creator owner.' The retained significant rights of the delegated administrator may not be well understood, potentially leading to unintended privilege escalation or security risks.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | samba | < samba 2:4.17.8+dfsg-1 (bookworm) | samba 2:4.17.8+dfsg-1 (bookworm) |
| samba | samba | >= 0 < 2:4.17.8+dfsg-1 | 2:4.17.8+dfsg-1 |
| samba | samba | >= 0 < 2:4.17.8+dfsg-1 | 2:4.17.8+dfsg-1 |
| samba | samba | >= 0 < 2:4.17.8+dfsg-1 | 2:4.17.8+dfsg-1 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2020-25720: A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes o
osv·2024-11-17·CVSS 7.5
CVE-2020-25720 [HIGH] CVE-2020-25720: A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes o
A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator owns the object due to the lack of an Access Control List (ACL) at the time of creation and later being recognized as the 'creator owner.' The retained significant rights of the delegated administrator may not be well understood, potentially leading to unintended privilege escalation or security risks.
GHSA
GHSA-r7p2-7qw3-phxg: A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes o
ghsa_unreviewed·2024-11-17
CVE-2020-25720 [HIGH] GHSA-r7p2-7qw3-phxg: A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes o
A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator owns the object due to the lack of an Access Control List (ACL) at the time of creation and later being recognized as the 'creator owner.' The retained significant rights of the delegated administrator may not be well understood, potentially leading to unintended privilege escalation or security risks.
Red Hat
samba: check attribute access rights for LDAP adds of computers
vendor_redhat·2022-06-14·CVSS 7.5
CVE-2020-25720 [HIGH] CWE-264 samba: check attribute access rights for LDAP adds of computers
samba: check attribute access rights for LDAP adds of computers
A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator owns the object due to the lack of an Access Control List (ACL) at the time of creation and later being recognized as the 'creator owner.' The retained significant rights of the delegated administrator may not be well understood, potentially leading to unintended privilege escalation or security risks.
A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to
Debian
CVE-2020-25720: samba - A vulnerability was found in Samba where a delegated administrator with permissi...
vendor_debian·2020·CVSS 7.5
CVE-2020-25720 [HIGH] CVE-2020-25720: samba - A vulnerability was found in Samba where a delegated administrator with permissi...
A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator owns the object due to the lack of an Access Control List (ACL) at the time of creation and later being recognized as the 'creator owner.' The retained significant rights of the delegated administrator may not be well understood, potentially leading to unintended privilege escalation or security risks.
Scope: local
bookworm: resolved (fixed in 2:4.17.8+dfsg-1)
bullseye: open
forky: resolved (fixed in 2:4.17.8+dfsg-1)
sid: resolved (fixed in 2:4.17.8+dfsg-1)
trixie: resolved (fixed in 2:4.17.8+dfsg-
No detection rules found.
No public exploits indexed.
2024-11-17
Published