CVE-2020-28169

HIGH 7.0CVE-2020-28169 · Published 24/12/2020 · updated 17/06/2026

In short

CVE-2020-28169 is a HIGH (CVSS 7.0) vulnerability affecting td-agent-builder (td-agent-builder project).
Chance of exploitation in the next 30 days (EPSS): 1.2%, higher than 67.6% of all vulnerabilities.
Fix: update to 2020-12-18 or later.

Package	Affected versions	Patched versions
td-agent-builder td-agent-builder_project	`< 2020-12-18`	`2020-12-18`

Description

The td-agent-builder plugin before 2020-12-18 for Fluentd allows attackers to gain privileges because the bin directory is writable by a user account, but a file in bin is executed as NT AUTHORITY\SYSTEM.

References

packetstormsecurity.com/files/160791/Fluentd-TD-agent-4.0.1-Insecure-Folder-Permission.html · Exploit
docs.fluentd.org/installation/install-by-msi · Product
fluent-plugins-nursery/td-agent-builder#247 · Patch
fluent/fluentd · Exploit
kenhys/td-agent-builder commit eec6e2d · Patch
td-agent-package-browser.herokuapp.com/4/windows · Third Party Advisory
debian.org/security/2021/dsa-4949 · Third Party Advisory
fluentd.org · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free