CVE-2021-20208 — Incorrect Privilege Assignment in Samba Cifs-utils
CWE-266 — Incorrect Privilege AssignmentCWE-269 — Improper Privilege Management11 documents8 sources
Severity
6.1MEDIUMNVD
OSV7.0
EPSS
0.4%
top 40.86%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedApr 19
Latest updateAug 7
Description
A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:NExploitability: 0.8 | Impact: 4.7
Affected Packages4 packages
Also affects: Fedora 33, 34, 35, Enterprise Linux 7.0, 8.0
Patches
🔴Vulnerability Details
5📋Vendor Advisories
5Microsoft▶
A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vuln↗2021-04-13
Red Hat
▶
Debian▶
CVE-2021-20208: cifs-utils - A flaw was found in cifs-utils in versions before 6.13. A user when mounting a k...↗2021