How severe is CVE-2020-1706?

This vulnerability has a severity rating of HIGH with a CVSS score of 7 out of 10.

What type of vulnerability is CVE-2020-1706?

This is classified as CWE-732, which is a common weakness in software security.

CVE-2020-1706 - HIGH Severity | CVSS 7

Vulnerability Description

It has been found that in openshift-enterprise version 3.11 and openshift-enterprise versions 4.1 up to, including 4.3, multiple containers modify the permissions of /etc/passwd to make them modifiable by users other than root. An attacker with access to the running container can exploit this to modify /etc/passwd to add a user and escalate their privileges. This CVE is specific to the openshift/apb-tools-container.

Related Vulnerabilities

CVE-2017-16933

HIGH

CVSS:7.0(High)

etc/initsystem/prepare-dirs in Icinga 2.x through 2.8.1 has a chown call for a filename in a user-writable directory, which allows local users to gain privileges by leveraging access to the $ICINGA2_U...

CWE-7322017

CVE-2017-18348

HIGH

CVSS:7.0(High)

Splunk Enterprise 6.6.x, when configured to run as root but drop privileges to a specific non-root account, allows local users to gain privileges by leveraging access to that non-root account to modif...

CWE-7322017

CVE-2018-0982

HIGH

CVSS:7.0(High)

An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions, aka "Windows Elevation of Privilege Vulnerability." This affects Windows Server 2016, Window...

CWE-7322018

CVE-2018-1036

HIGH

CVSS:7.0(High)

An elevation of privilege vulnerability exists when NTFS improperly checks access, aka "NTFS Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Wind...

CWE-7322018

CVE-2018-1141

HIGH

CVSS:7.0(High)

When installing Nessus to a directory outside of the default location, Nessus versions prior to 7.0.3 did not enforce secure permissions for sub-directories. This could allow for local privilege escal...

CWE-7322018

CVE-2018-19374

HIGH

CVSS:7.0(High)

Zoho ManageEngine ADManager Plus 6.6 Build 6657 allows local users to gain privileges (after a reboot) by placing a Trojan horse file into the permissive bin directory.

CWE-7322018