Every CVE Search/ Get API key

CVE-2020-25697

A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for...

7.0 HighFix available

A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients. This flaw allows an attacker to take control of an X application by impersonating the server it is expecting to connect to.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.31%Down 0.9 points since May 27, 2021
90%50%10%1%

What each source reports

NVD Score used 7.0

A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients. This flaw allows an attacker to take control of an X application by impersonating the server it is expecting to connect to.

Record
CVE-2020-25697
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
4.4 MediumAV:L/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-306
Updated
2026-11-02
CVE List No score

A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients. This flaw allows an attacker to take control of an X application by impersonating the server it is expecting to connect to.

Record
CVE-2020-25697
Weakness
CWE-306
Updated
2026-11-02
EUVDEUVD-2020-18358 No score

A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients. This flaw allows an attacker to take control of an X application by impersonating the server it is expecting to connect to.

Record
EUVD-2020-18358
Updated
2026-11-03
GitHub AdvisoriesGHSA-qrj9-jg63-p8hg 7.0

A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for...

A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients. This flaw allows an attacker to take control of an X application by impersonating the server it is expecting to connect to.

Record
GHSA-qrj9-jg63-p8hg
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-306
Updated
2026-11-02
OSVUBUNTU-CVE-2020-25697 7.0

A privilege escalation flaw was found in the Xorg-x11-server due to a lack of authentication for X11 clients. This flaw allows an attacker to take control of an X application by impersonating the server it is expecting to connect to.

Record
UBUNTU-CVE-2020-25697
CVSS 3.1
7.0 HighCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2024:12993-1 No score

xtrans-1.5.0-1.1 on GA media

These are all security issues fixed in the xtrans-1.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12993-1
Updated
2026-11-02
OSVSUSE-SU-2023:3189-1 No score

Security update for xtrans

This update for xtrans fixes the following issues:

  • CVE-2020-25697: Fixed local privilege escalation via TRANS_ABSTRACT on the client side (bsc#1178613).
Record
SUSE-SU-2023:3189-1
Updated
2026-11-02
OSVSUSE-SU-2023:3190-1 No score

Security update for xtrans

This update for xtrans fixes the following issues:

  • CVE-2020-25697: Fixed local privilege escalation via TRANS_ABSTRACT on the client side (bsc#1178613).
Record
SUSE-SU-2023:3190-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
xtrans
SUSE:Linux Enterprise Software Development Kit 12 SP5
 before 1.3.5-5.3.1
1.3.5-5.3.1
xtrans
SUSE:Linux Enterprise Module for Basesystem 15 SP4
 before 1.3.5-150000.3.3.1
1.3.5-150000.3.3.1
xtrans
SUSE:Linux Enterprise Module for Basesystem 15 SP5
 before 1.3.5-150000.3.3.1
1.3.5-150000.3.3.1
xtrans
SUSE:Linux Enterprise Real Time 15 SP3
 before 1.3.5-150000.3.3.1
1.3.5-150000.3.3.1
xtrans
openSUSE:Leap 15.4
 before 1.3.5-150000.3.3.1
1.3.5-150000.3.3.1
xtrans
openSUSE:Leap 15.5
 before 1.3.5-150000.3.3.1
1.3.5-150000.3.3.1
libx11
Ubuntu:Pro:14.04:LTS
 All versions, plus listed versions
2:1.6.1-1ubuntu12:1.6.1-1ubuntu22:1.6.2-1ubuntu12:1.6.2-1ubuntu22:1.6.2-1ubuntu2.1
Show 6 moreShow less
2:1.6.2-1ubuntu2.1+esm12:1.6.2-1ubuntu2.1+esm22:1.6.2-1ubuntu2.1+esm32:1.6.2-1ubuntu2.1+esm42:1.6.2-1ubuntu2.1+esm52:1.6.2-1ubuntu2.1+esm6
 None known
libx11
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2:1.6.3-1ubuntu22:1.6.3-1ubuntu2.12:1.6.3-1ubuntu2.22:1.6.3-1ubuntu2.2+esm12:1.6.3-1ubuntu2.2+esm22:1.6.3-1ubuntu2.2+esm32:1.6.3-1ubuntu2.2+esm42:1.6.3-1ubuntu2.2+esm5
 None known
libx11
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2:1.6.4-32:1.6.4-3ubuntu0.12:1.6.4-3ubuntu0.22:1.6.4-3ubuntu0.32:1.6.4-3ubuntu0.42:1.6.4-3ubuntu0.4+esm12:1.6.4-3ubuntu0.4+esm22:1.6.4-3ubuntu0.4+esm3
 None known
libx11
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2:1.6.8-12:1.6.9-22:1.6.9-2ubuntu12:1.6.9-2ubuntu1.12:1.6.9-2ubuntu1.22:1.6.9-2ubuntu1.52:1.6.9-2ubuntu1.62:1.6.9-2ubuntu1.6+esm1
 None known
libx11
Ubuntu:22.04:LTS
 All versions, plus listed versions
2:1.7.2-12:1.7.2-22:1.7.2-2build12:1.7.5-12:1.7.5-1ubuntu0.22:1.7.5-1ubuntu0.32:1.7.5-1ubuntu0.4
 None known
xtrans
openSUSE:Tumbleweed
 before 1.5.0-1.1
1.5.0-1.1

History

History
RecordedChangedSources
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-25697 is a high vulnerability (CVSS 7.0) in The Xorg Project Xorg-x11-server, published May 26, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in xtrans 1.3.5-5.3.1.

References

Show 9 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open