What is the CVSS score of CVE-2020-26273?

CVE-2020-26273 has a CVSS 3.1 base score of 5.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.9%.

Is there a public PoC exploit available for CVE-2020-26273?

Yes, a public proof-of-concept exploit is available for CVE-2020-26273. Prioritise patching immediately. EPSS: 0.9%.

Is there a patch available for CVE-2020-26273?

Yes, a patch is available for CVE-2020-26273. Update the affected software to the latest version immediately.

Osquery CVE-2020-26273

MEDIUM

Command Injection (CWE-77)

2020-12-16 security-advisories@github.com

Command Injection Osquery

5.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.2 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

Dec 16, 2020 - 02:15 nvd

MEDIUM 5.2

DescriptionNVD

osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. In osquery before version 4.6.0, by using sqlite's ATTACH verb, someone with administrative access to osquery can cause reads and writes to arbitrary sqlite databases on disk. This _does_ allow arbitrary files to be created, but they will be sqlite databases. It does not appear to allow existing non-sqlite files to be overwritten. This has been patched in osquery 4.6.0. There are several mitigating factors and possible workarounds. In some deployments, the people with access to these interfaces may be considered administrators. In some deployments, configuration is managed by a central tool. This tool can filter for the ATTACH keyword. osquery can be run as non-root user. Because this also limits the desired access levels, this requires deployment specific testing and configuration.

AnalysisAI

osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Rated medium severity (CVSS 5.2), this vulnerability is low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Command Injection (CWE-77), which allows attackers to inject arbitrary commands into system command execution. osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. In osquery before version 4.6.0, by using sqlite's ATTACH verb, someone with administrative access to osquery can cause reads and writes to arbitrary sqlite databases on disk. This _does_ allow arbitrary files to be created, but they will be sqlite databases. It does not appear to allow existing non-sqlite files to be overwritten. This has been patched in osquery 4.6.0. There are several mitigating factors and possible workarounds. In some deployments, the people with access to these interfaces may be considered administrators. In some deployments, configuration is managed by a central tool. This tool can filter for the ATTACH keyword. osquery can be run as non-root user. Because this also limits the desired access levels, this requires deployment specific testing and configuration. Affected products include: Linuxfoundation Osquery. Version information: version 4.6.0.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Use parameterized APIs, avoid shell execution, validate input with strict allowlists.