CVE-2020-7954

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An issue was discovered in OpServices OpMon 9.3.2. Starting from the apache user account, it is possible to perform privilege escalation through the lack of correct configuration in the server's sudoers file, which by default allows the execution of programs (e.g. nmap) without the need for a password with sudo.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published
Feb 6, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-79555.3HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential uCVE-2020-79569.8HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and CVE-2020-79575.3The IMAP and LMTP components in Dovecot 2.3.9 before 2.3.9.3 mishandle snippet generation when many characters must be read to compute the sCVE-2020-79586.0An issue was discovered on OnePlus 7 Pro devices before 10.0.3.GM21BA. The firmware was found to contain functionality that allows a privileCVE-2020-79595.3LabVantage LIMS 8.3 does not properly maintain the confidentiality of database names. For example, the web application exposes the database CVE-2020-79619.8Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web serCVE-2020-79625.3An issue was discovered in One Identity Password Manager 5.8. An attacker could enumerate valid answers for a user. It is possible for an atCVE-2020-79645.3An issue was discovered in Mirumee Saleor 2.x before 2.9.1. Incorrect access control in the checkoutCustomerAttach mutations allows attackerCVE-2020-79658.8flaskparser.py in Webargs 5.x through 5.5.2 doesn't check that the Content-Type header is application/json when receiving JSON input. If theCVE-2020-79667.5GitLab EE 11.11 and later through 12.7.2 allows Directory Traversal.CVE-2020-79674.3GitLab EE 8.0 through 12.7.2 has Insecure Permissions (issue 1 of 2).CVE-2020-79687.5GitLab EE 8.0 through 12.7.2 has Incorrect Access Control.