CVE-2020-27348

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This issue affects snapcraft versions prior to 4.4.4, prior to 2.43.1+16.04.1, and prior to 2.43.1+18.04.1.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-427

Affected software

No affected versions have been published.

Timeline

Published: Dec 4, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-273495.5Aptdaemon performed policykit checks after interacting with potentially untrusted files with elevated privileges. This affected versions pri CVE-2020-27358.0Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c CVE-2020-273505.7APT had several integer overflows and underflows while parsing .deb packages, aka GHSL-2020-168 GHSL-2020-169, in files apt-pkg/contrib/extr CVE-2020-273512.8Various memory and file descriptor leaks were found in apt-python files python/arfile.cc, python/tag.cc, python/tarfile.cc, aka GHSL-2020-17 CVE-2020-273528.8When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result s CVE-2020-273565.4The debug-meta-data plugin 1.1.2 for WordPress allows XSS.CVE-2020-273584.3An issue was discovered in REDCap 8.11.6 through 9.x before 10. The messenger's CSV feature (that allows users to export their conversation CVE-2020-273595.4A cross-site scripting (XSS) issue in REDCap 8.11.6 through 9.x before 10 allows attackers to inject arbitrary JavaScript or HTML in the Mes CVE-2020-273617.5An issue exists within Akkadian Provisioning Manager 4.50.02 which allows attackers to view sensitive information within the /pme subdirecto CVE-2020-273628.8An issue exists within the SSH console of Akkadian Provisioning Manager 4.50.02 which allows a low-level privileged user to escape the web c CVE-2020-273666.1Cross Site Scripting (XSS) vulnerability in wlscanresults.html in Humax HGB10R-02 BRGCAB version 1.0.03, allows local attackers to execute a CVE-2020-273685.5Directory Indexing in Login Portal of Login Portal of TOTOLINK-A702R-V1.0.0-B20161227.1023 allows attacker to access /icons/ directories via