CVE-2020-25718

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A flaw was found in the way samba, as an Active Directory Domain Controller, is able to support an RODC (read-only domain controller). This would allow an RODC to print administrator tickets.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
n/a	samba	samba 4.15.2, samba 4.14.10, samba 4.13.14

References

https://bugzilla.redhat.com/show_bug.cgi?id=2019726Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/202309-06
https://www.samba.org/samba/security/CVE-2020-25718.htmlVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2019726Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/202309-06
https://www.samba.org/samba/security/CVE-2020-25718.htmlVendor Advisory

Timeline

Published: Feb 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-257197.2A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC CVE-2020-25722.7Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Audit Plugin). Supported versions that are affected are 5.7.28 CVE-2020-257207.5A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all at CVE-2020-257218.8Kerberos acceptors need easy access to stable AD identifiers (eg objectSid). Samba as an AD DC now provides a way for Linux applications to CVE-2020-257228.8Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw CVE-2020-257233.2A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing ha CVE-2020-257244.3A flaw was found in RESTEasy, where an incorrect response to an HTTP request is provided. This flaw allows an attacker to gain access to pri CVE-2020-257255.5In Xpdf 4.02, SplashOutputDev::endType3Char(GfxState *state) SplashOutputDev.cc:3079 is trying to use the freed `t3GlyphStack->cache`, which CVE-2020-257277.5The Reset Password add-on before 1.2.0 for Alfresco suffers from CMIS-SQL Injection, which allows a malicious user to inject a query within CVE-2020-257288.8The Reset Password add-on before 1.2.0 for Alfresco has a broken algorithm (involving an increment) that allows a malicious user to change a CVE-2020-257296.1ZoneMinder before 1.34.21 has XSS via the connkey parameter to download.php or export.php.CVE-2020-25735.9Vulnerability in the MySQL Client product of Oracle MySQL (component: C API). Supported versions that are affected are 5.7.28 and prior and