PT-2020-13295 · Pydio · Pydio Cells Enterprise Ovf

Published 2020-06-11 · Updated 2020-06-22 · CVE-2020-12850

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pydio Cells Enterprise OVF version 2.0.4 Pydio Cells Enterprise OVF versions prior to 2.0.4

Description The issue concerns insecure permissions that could allow local privilege escalation. In version 2.0.4 of the appliance, the pydio user is responsible for running services and binaries, including mysqld and cells, with restricted privileges. Prior versions have a looser policy restriction, allowing the pydio user to execute any privileged command using sudo.

Recommendations For Pydio Cells Enterprise OVF version 2.0.4, consider restricting the pydio user's privileges to only run necessary services and binaries. For Pydio Cells Enterprise OVF versions prior to 2.0.4, update the policy restriction to limit the pydio user's ability to execute privileged commands using sudo. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2020-12850

Affected Products

Pydio Cells Enterprise Ovf

References · 6

• 🔥 https://coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilities · Exploit
• https://osv.dev/vulnerability/CVE-2020-12850 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12850 · Security Note
• http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.html · Note
• https://coresecurity.com/advisories · Note
• https://t.me/cvenotify/4298 · Telegram Post