CVE-2020-8446

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to path traversal (with write access) via crafted syscheck messages written directly to the analysisd UNIX domain socket by a local user.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://github.com/ossec/ossec-hids/issues/1813Exploit, Third Party Advisory
https://github.com/ossec/ossec-hids/issues/1821Third Party Advisory
https://security.gentoo.org/glsa/202007-33Third Party Advisory
https://www.ossec.net/Vendor Advisory
https://github.com/ossec/ossec-hids/issues/1813Exploit, Third Party Advisory
https://github.com/ossec/ossec-hids/issues/1821Third Party Advisory
https://security.gentoo.org/glsa/202007-33Third Party Advisory
https://www.ossec.net/Vendor Advisory

Timeline

Published: Jan 30, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-84479.8In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a use-after-free durin CVE-2020-84485.5In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to a denial of service (N CVE-2020-84497.5An issue was discovered in Squid before 4.10. Due to incorrect input validation, it can interpret crafted HTTP requests in unexpected ways t CVE-2020-84507.3An issue was discovered in Squid before 4.10. Due to incorrect buffer management, a remote client can cause a buffer overflow in a Squid ins CVE-2020-84618.8A CSRF protection bypass vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to get a vict CVE-2020-84624.8A cross-site scripting (XSS) vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to tamper CVE-2020-84637.5A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to bypass a global authorization che CVE-2020-84647.5A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to send requests that appear to come CVE-2020-84659.8A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to manipulate system updates using a CVE-2020-84669.8A command injection vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2, with the improved password hashing method CVE-2020-84678.8A migration tool component of Trend Micro Apex One (2019) and OfficeScan XG contains a vulnerability which could allow remote attackers to e CVE-2020-84688.8Trend Micro Apex One (2019), OfficeScan XG and Worry-Free Business Security (9.0, 9.5, 10.0) agents are affected by a content validation esc