CVE-2020-17049

MediumCVSS 6.6/10Last modified Jun 17, 2026

Description

A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD). To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it. The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Nov 11, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-17057.0A vulnerability was found in openshift/template-service-broker-operator in all 4.x.x versions prior to 4.3.0, where an insecure modification CVE-2020-170519.8Windows Network File System Remote Code Execution Vulnerability CVE-2020-170527.5Scripting Engine Memory Corruption Vulnerability CVE-2020-170537.5Internet Explorer Memory Corruption Vulnerability CVE-2020-170544.2Chakra Scripting Engine Memory Corruption Vulnerability CVE-2020-170557.8Windows Remote Access Elevation of Privilege Vulnerability CVE-2020-170565.5Windows Network File System Information Disclosure Vulnerability CVE-2020-170577.0Windows Win32k Elevation of Privilege Vulnerability CVE-2020-170587.5Microsoft Browser Memory Corruption Vulnerability CVE-2020-17067.0It has been found that in openshift-enterprise version 3.11 and openshift-enterprise versions 4.1 up to, including 4.3, multiple containers CVE-2020-170605.4Microsoft SharePoint Server Spoofing Vulnerability CVE-2020-170618.8Microsoft SharePoint Remote Code Execution Vulnerability