CVE-2020-17477

MEDIUM 6.5CVE-2020-17477 · Published 26/10/2023 · updated 17/06/2026

In short

CVE-2020-17477 is a MEDIUM (CVSS 6.5) vulnerability affecting ucs@school (univention).
Chance of exploitation in the next 30 days (EPSS): 0.45%, higher than 39.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
ucs@school univention	`≤ 4.4`	No fix yet

Description

Incorrect LDAP ACLs in ucs-school-ldap-acls-master in UCS@school before 4.4v5-errata allow remote teachers, staff, and school administrators to read LDAP password hashes (sambaNTPassword, krb5Key, sambaPasswordHistory, and pwhistory) via LDAP search requests. For example, a teacher can gain administrator access via an NTLM hash.

References

forge.univention.org/bugzilla/show_bug.cgi · Issue Tracking

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free