What is the CVSS score of CVE-2020-15703?

CVE-2020-15703 has a CVSS 3.1 base score of 3.3 (Low). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.5%.

Is there a public PoC exploit available for CVE-2020-15703?

Yes, a public proof-of-concept exploit is available for CVE-2020-15703. Prioritise patching immediately. EPSS: 0.5%.

Is there a patch available for CVE-2020-15703?

Yes, a patch is available for CVE-2020-15703. Update the affected software to the latest version immediately.

Aptdaemon CVE-2020-15703

LOW

Path Traversal (CWE-22)

2020-10-31 security@ubuntu.com

Path Traversal Aptdaemon

3.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

3.3 LOW

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Oct 31, 2020 - 04:15 nvd

LOW 3.3

DescriptionNVD

There is no input validation on the Locale property in an apt transaction. An unprivileged user can supply a full path to a writable directory, which lets aptd read a file as root. Having a symlink in place results in an error message if the file exists, and no error otherwise. This way an unprivileged user can check for the existence of any files on the system as root.

AnalysisAI

There is no input validation on the Locale property in an apt transaction. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. There is no input validation on the Locale property in an apt transaction. An unprivileged user can supply a full path to a writable directory, which lets aptd read a file as root. Having a symlink in place results in an error message if the file exists, and no error otherwise. This way an unprivileged user can check for the existence of any files on the system as root. Affected products include: Aptdaemon Project Aptdaemon.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.