CVE-2020-14318

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A flaw was found in the way samba handled file and directory permissions. An authenticated user could use this flaw to gain access to certain file and directory information which otherwise would be unavailable to the attacker.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-266 CWE-269

Affected software

Vendor	Product	Versions
n/a	samba	samba 4.11.15, samba 4.12.9, samba 4.13.1
redhat	storage	3.0
redhat	enterprise_linux	-

References

https://bugzilla.redhat.com/show_bug.cgi?id=1892631Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/04/msg00015.html
https://security.gentoo.org/glsa/202012-24Third Party Advisory
https://www.samba.org/samba/security/CVE-2020-14318.htmlVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1892631Issue Tracking, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/04/msg00015.html
https://security.gentoo.org/glsa/202012-24Third Party Advisory
https://www.samba.org/samba/security/CVE-2020-14318.htmlVendor Advisory

Timeline

Published: Dec 3, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-143195.9It was found that the AMQ Online console is vulnerable to a Cross-Site Request Forgery (CSRF) which is exploitable in cases where preflight CVE-2020-14324.3An information disclosure vulnerability exists when Skype for Business is accessed via Internet Explorer, aka 'Skype for Business via Intern CVE-2020-143206.1In Moodle before 3.9.1, 3.8.4 and 3.7.7, the filter in the admin task log required extra sanitizing to prevent a reflected XSS risk.CVE-2020-143218.8In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, teachers of a course were able to assign themselves the manager role within that course.CVE-2020-143227.5In Moodle before 3.9.1, 3.8.4, 3.7.7 and 3.5.13, yui_combo needed to limit the amount of files it can load to help mitigate the risk of deni CVE-2020-143235.5A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. A local us CVE-2020-143249.1A high severity vulnerability was found in all active versions of Red Hat CloudForms before 5.11.7.0. The out of band OS command injection v CVE-2020-143259.1Red Hat CloudForms before 5.11.7.0 was vulnerable to the User Impersonation authorization flaw which allows malicious attacker to create exi CVE-2020-143267.5A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes. This issue results in hash flooding, leading to slower requ CVE-2020-143275.5A Server-side request forgery (SSRF) flaw was found in Ansible Tower in versions before 3.6.5 and before 3.7.2. Functionality on the Tower s CVE-2020-143283.3A flaw was found in Ansible Tower in versions before 3.7.2. A Server Side Request Forgery flaw can be abused by supplying a URL which could CVE-2020-143293.3A data exposure flaw was found in Ansible Tower in versions before 3.7.2, where sensitive data can be exposed from the /api/v2/labels/ endpo