HOMEVULNERABILITIESCVE-2020-14004
HIGH

CVE-2020-14004

CWE-59Published: June 12, 2020· Updated: Jun 17, 2026

7.8
CVSS v3.1

Official Description

An issue was discovered in Icinga2 before v2.12.0-rc1. The prepare-dirs script (run as part of the icinga2 systemd service) executes chmod 2750 /run/icinga2/cmd. /run/icinga2 is under control of an unprivileged user by default. If /run/icinga2/cmd is a symlink, then it will by followed and arbitrary files can be changed to mode 2750 by the unprivileged icinga2 user.

NVD Source

Technical Analysis

CVE-2020-14004 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires low privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 7.8.

CVSS v3.1 Vector Breakdown

Exploitability
Attack VectorLocal
Attack ComplexityLow
Privileges Req.Low
User InteractionNone
ScopeUnchanged
Impact
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Vendors & Products

icinga1 product(s)
icinga
openSUSE2 product(s)
backports sleleap
Source: NVD CPE · 5 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time
Exploit-DB
Offensive Security exploit database
GitHub PoC Search
Community PoC repositories
Rapid7 / Metasploit
Metasploit module search
PacketStorm
Security advisories & exploits
NVD Detail
Official NIST entry
MITRE CVE
CVE Program entry
External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

PATCHhttps://github.com/Icinga/icinga2/pull/8045/commits/2f0f2e8c355b75fa4407d23f85feea037d2bc4b6
PATCHhttps://github.com/Icinga/icinga2/pull/8045/commits/2f0f2e8c355b75fa4407d23f85feea037d2bc4b6
ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2020-11/msg00014.html
ADVISORYhttp://www.openwall.com/lists/oss-security/2020/06/12/1
ADVISORYhttps://github.com/Icinga/icinga2/compare/v2.12.0-rc1...master
ADVISORYhttps://github.com/Icinga/icinga2/releases
ADVISORYhttp://lists.opensuse.org/opensuse-security-announce/2020-11/msg00014.html
ADVISORYhttp://www.openwall.com/lists/oss-security/2020/06/12/1
ADVISORYhttps://github.com/Icinga/icinga2/compare/v2.12.0-rc1...master
ADVISORYhttps://github.com/Icinga/icinga2/releases

All References (12)

→
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00014.htmlBroken Link · Mailing List · Third Party Advisory
→
http://www.openwall.com/lists/oss-security/2020/06/12/1Exploit · Mailing List · Third Party Advisory
→
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2020-14004Broken Link · Issue Tracking
→
https://github.com/Icinga/icinga2/compare/v2.12.0-rc1...masterThird Party Advisory
→
https://github.com/Icinga/icinga2/pull/8045/commits/2f0f2e8c355b75fa4407d23f85feea037d2bc4b6Patch · Third Party Advisory
→
https://github.com/Icinga/icinga2/releasesRelease Notes · Third Party Advisory
→
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00014.htmlBroken Link · Mailing List · Third Party Advisory
→
http://www.openwall.com/lists/oss-security/2020/06/12/1Exploit · Mailing List · Third Party Advisory
→
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2020-14004Broken Link · Issue Tracking
→
https://github.com/Icinga/icinga2/compare/v2.12.0-rc1...masterThird Party Advisory
→
https://github.com/Icinga/icinga2/pull/8045/commits/2f0f2e8c355b75fa4407d23f85feea037d2bc4b6Patch · Third Party Advisory
→
https://github.com/Icinga/icinga2/releasesRelease Notes · Third Party Advisory

Quick Facts

CVE IDCVE-2020-14004
CVSS Score7.8 / 10
SeverityHIGH
WeaknessCWE-59
CISA KEVNo
Affected2 vendor(s)
PublishedJun 12, 2020

Related CVEs (CWE-59)

CVE-2002-2374
10.0
CVE-2014-4480
10.0
CVE-2024-28189
10.0
CVE-2024-28185
10.0
CVE-2026-44881
9.9
CVE-2018-5225
9.9

Recommended Actions

  • →Apply vendor patches immediately
  • →Monitor CVE-2020-14004 in threat intel feeds
  • →Review IDS/IPS signatures for exploitation attempts
Data sourced from NVD (NIST), CISA KEV, and EPSS (FIRST). Analysis generated by CTIWATCH.COM. CVE data is provided under the NVD usage policy.
← All Vulnerabilities·Search for CVE-2020-14004·NVD