HOME VULNERABILITIESCVE-2019-20044

HIGH

CVE-2019-20044

CWE-273Published: February 24, 2020· Updated: Jun 17, 2026

7.8

CVSS v3.1

Official Description

In Zsh before 5.8, attackers able to execute commands can regain privileges dropped by the --no-PRIVILEGED option. Zsh fails to overwrite the saved uid, so the original privileges can be restored by executing MODULE_PATH=/dir/with/module zmodload with a module that calls setuid().

Technical Analysis

CVE-2019-20044 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorLocal

Attack ComplexityLow

Privileges Req.Low

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Vendors & Products

Apple6 product(s)

macosipadosiphone osmac os xtvoswatchos

Debian1 product(s)

debian linux

Fedora1 product(s)

fedora

Linux1 product(s)

linux kernel

zsh1 product(s)

zsh

Source: NVD CPE · 14 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

Security advisories & exploits

Official NIST entry

CVE Program entry

External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

ADVISORYhttp://seclists.org/fulldisclosure/2020/May/49

ADVISORYhttp://seclists.org/fulldisclosure/2020/May/53

ADVISORYhttp://seclists.org/fulldisclosure/2020/May/55

ADVISORYhttp://seclists.org/fulldisclosure/2020/May/59

ADVISORYhttp://zsh.sourceforge.net/releases.html

ADVISORYhttps://lists.debian.org/debian-lts-announce/2020/03/msg00004.html

ADVISORYhttps://lists.debian.org/debian-lts-announce/2020/12/msg00000.html

ADVISORYhttps://security.gentoo.org/glsa/202003-55

ADVISORYhttps://support.apple.com/HT211168

ADVISORYhttps://support.apple.com/HT211170

ADVISORYhttps://support.apple.com/HT211171

ADVISORYhttps://support.apple.com/HT211175

ADVISORYhttps://support.apple.com/kb/HT211168

ADVISORYhttps://support.apple.com/kb/HT211170

ADVISORYhttps://support.apple.com/kb/HT211171

ADVISORYhttps://support.apple.com/kb/HT211175

ADVISORYhttps://www.zsh.org/mla/zsh-announce/141

ADVISORYhttp://seclists.org/fulldisclosure/2020/May/49

ADVISORYhttp://seclists.org/fulldisclosure/2020/May/53

ADVISORYhttp://seclists.org/fulldisclosure/2020/May/55

ADVISORYhttp://seclists.org/fulldisclosure/2020/May/59

ADVISORYhttp://zsh.sourceforge.net/releases.html

ADVISORYhttps://lists.debian.org/debian-lts-announce/2020/03/msg00004.html

ADVISORYhttps://lists.debian.org/debian-lts-announce/2020/12/msg00000.html

ADVISORYhttps://security.gentoo.org/glsa/202003-55

ADVISORYhttps://support.apple.com/HT211168

ADVISORYhttps://support.apple.com/HT211170

ADVISORYhttps://support.apple.com/HT211171

ADVISORYhttps://support.apple.com/HT211175

ADVISORYhttps://support.apple.com/kb/HT211168

ADVISORYhttps://support.apple.com/kb/HT211170

ADVISORYhttps://support.apple.com/kb/HT211171

ADVISORYhttps://support.apple.com/kb/HT211175

ADVISORYhttps://www.zsh.org/mla/zsh-announce/141

All References (40)

→

http://seclists.org/fulldisclosure/2020/May/49Mailing List · Third Party Advisory

→

http://seclists.org/fulldisclosure/2020/May/53Mailing List · Third Party Advisory

→

http://seclists.org/fulldisclosure/2020/May/55Mailing List · Third Party Advisory

→

http://seclists.org/fulldisclosure/2020/May/59Mailing List · Third Party Advisory

→

http://zsh.sourceforge.net/releases.htmlRelease Notes · Third Party Advisory

→

https://github.com/XMB5/zsh-privileged-upgradeBroken Link

→

https://lists.debian.org/debian-lts-announce/2020/03/msg00004.htmlMailing List · Third Party Advisory

→

https://lists.debian.org/debian-lts-announce/2020/12/msg00000.htmlMailing List · Third Party Advisory

→

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FP64FFIZI2CKQOEAOI5A72PVQULE7ZZC/

→

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PN5V7MPHRRP7QNHOEK56S7QGRU53WUN6/

→

https://security.gentoo.org/glsa/202003-55Third Party Advisory

→

https://support.apple.com/HT211168Third Party Advisory

→

https://support.apple.com/HT211170Third Party Advisory

→

https://support.apple.com/HT211171Third Party Advisory

→

https://support.apple.com/HT211175Third Party Advisory

Quick Facts

CVE IDCVE-2019-20044

CVSS Score7.8 / 10

SeverityHIGH

WeaknessCWE-273

CISA KEVNo

Affected5 vendor(s)

PublishedFeb 24, 2020

Related CVEs (CWE-273)

Recommended Actions

→Apply vendor patches immediately
→Monitor CVE-2019-20044 in threat intel feeds
→Review IDS/IPS signatures for exploitation attempts

Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.

← All Vulnerabilities·Search for CVE-2019-20044·NVD