NVD Vulnerability Detail

CVE-2020-12850

Summary	The following vulnerability applies only to the Pydio Cells Enterprise OVF version 2.0.4. Prior versions of the Pydio Cells Enterprise OVF (such as version 2.0.3) have a looser policy restriction allowing the “pydio” user to execute any privileged command using sudo. In version 2.0.4 of the appliance, the user pydio is responsible for running all the services and binaries that are contained in the Pydio Cells web application package, such as mysqld, cells, among others. This user has privileges restricted to run those services and nothing more.
Publication Date	June 11, 2020, 11:15 a.m.
Registration Date	Jan. 26, 2021, 11:51 a.m.
Last Update	Nov. 21, 2024, 2 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:pydio:cells:2.0.4::::enterprise:::

Related information, measures and tools

No	URL	タグ
1	http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.html	Third Party Advisory VDB Entry
2	https://www.coresecurity.com/advisories	Third Party Advisory
3	https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilities	Exploit Third Party Advisory
4	http://packetstormsecurity.com/files/158002/Pydio-Cells-2.0.4-XSS-File-Write-Code-Execution.html	Third Party Advisory VDB Entry
5	https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilities	Exploit Third Party Advisory
6	https://www.coresecurity.com/advisories	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-269	不適切な権限管理	https://cwe.mitre.org/data/definitions/269.html

JVN Vulnerability Information

Pydio Cells Enterprise OVF における権限管理に関する脆弱性

Title	Pydio Cells Enterprise OVF における権限管理に関する脆弱性
Summary	Pydio Cells Enterprise OVF には、権限管理に関する脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	May 28, 2020, midnight
Registration Date	July 20, 2020, 11:55 a.m.
Last Update	July 20, 2020, 11:55 a.m.

Affected System

Pydio

Cells Enterprise OVF 2.0.4 およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-12850	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12850
National Vulnerability Database (NVD)
2	CVE-2020-12850	https://nvd.nist.gov/vuln/detail/CVE-2020-12850

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-269	https://cwe.mitre.org/data/definitions/269.html

ベンダー情報

No	Name	URL
Pydio
1	Top Page	https://pydio.com/en

その他

No	Name	URL
関連文書
1	Pydio Cells 2.0.4 Multiple Vulnerabilities	https://www.coresecurity.com/core-labs/advisories/pydio-cells-204-multiple-vulnerabilities

Change Log

No	Changed Details	Date of change
1	[2020年07月20日] 掲載	July 20, 2020, 11:55 a.m.