Back to overview

CVE-2020-14871

CRITICAL KEV CISA Exploitation: ACTIVE
10.0
CVSS 3.1
Description
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. Note: This CVE is not exploitable for Solaris 11.1 and later releases, and ZFSSA 8.7 and later releases, thus the CVSS Base Score is 0.0. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Metadata

CVE ID
CVE-2020-14871
State
PUBLISHED
Assigner
oracle
Reserved
2020-06-19 00:00 UTC
Published
2020-10-21 14:04 UTC
Last updated
2025-10-21 23:35 UTC
Primary CWE
CWE-787
CWE-787 Out-of-bounds Write
Vendor / Product
Oracle Corporation / Solaris Operating System
Sources
cve.org  ·  NVD

Severity & Metrics

10.0 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
ACTIVE
Automatable
no
Tech. Impact
total
CISA Known Exploited Vulnerability
Vulnerability name
Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability
Vendor
Oracle
Product
Solaris and Zettabyte File System (ZFS)
Added to KEV
2021-11-03
Due date
2022-05-03
Ransomware
Not known
Required action
Apply updates per vendor instructions.
CISA description
Oracle Solaris and Oracle ZFS Storage Appliance Kit contain an unspecified vulnerability causing high impacts to confidentiality, integrity, and availability of affected systems.
Affected products (1)
VendorProductPlatformVersions
Oracle Corporation Solaris Operating System — 10, 11
Weakness (CWE)
CWESourceDescription
— cna Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris.
CWE-787 adp CWE-787 Out-of-bounds Write
CVSS scores (1)
ScoreSeverityVersionSourceVector
10.0 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References (7)
Back to overview