CVE-2020-13776: Medium severity ibm cloud pak for security vulnerability
systemd could allow a local authenticated attacker to gain elevated privileges on the system, caused by the mishandling of numerical usernames. By sending a specially-crafted request, an attacker could exploit this vulnerability to gain elevated privileges as root.
Other sources
systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-13776?
CVE-2020-13776 is a vulnerability in systemd that allows a local authenticated attacker to gain elevated privileges on the system.
How does CVE-2020-13776 affect the affected software?
CVE-2020-13776 affects systemd versions up to 245, Apple iPadOS, Netapp Solidfire & Hci Management Node, Fedoraproject Fedora (version 32), and IBM Cloud Pak for Security (CP4S) versions up to 1.7.2.0.
What is the severity of CVE-2020-13776?
The severity of CVE-2020-13776 is rated as medium with a score of 6.7.
What is the CWE category of CVE-2020-13776?
The CWE category of CVE-2020-13776 is CWE-269.
How can I fix CVE-2020-13776?
To fix CVE-2020-13776, update systemd to version 245 or newer, or apply the necessary patches provided by the affected software vendors.