« Volver al listado

CVE-2020-13095

Estado: ModificadaAlta (8.8)—

Little Snitch version 4.5.1 and older changed ownership of a directory path controlled by the user. This allowed the user to escalate to root by linking the path to a directory containing code executed by root.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Obdev — Little Snitch

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-13095",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "office@obdev.at",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Little Snitch",
          "versions": [
            {
              "status": "affected",
              "version": "up to 4.5.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-06-30T17:15:10.610",
  "references": [
    {
      "url": "https://obdev.at/cve/2020-13095-t46oXJJOwz.html",
      "source": "office@obdev.at"
    },
    {
      "url": "https://obdev.at/cve/2020-13095-t46oXJJOwz.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "office@obdev.at",
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Little Snitch version 4.5.1 and older changed ownership of a directory path controlled by the user. This allowed the user to escalate to root by linking the path to a directory containing code executed by root."
    },
    {
      "lang": "es",
      "value": "Little Snitch versión 4.5.1 y anteriores, cambiaron la propiedad de una ruta de directorio controlada por el usuario. Esto permitió al usuario escalar a root al enlazar la ruta a un directorio que contiene código ejecutado por root"
    }
  ],
  "lastModified": "2026-06-17T02:52:37.890",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:obdev:little_snitch:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1A9D08E4-5785-4AEF-83B1-C95BC6B2D413",
              "versionEndIncluding": "4.5.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "office@obdev.at"
}