CVE-2020-14342
It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password,...
It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.
- Record
CVE-2020-14342- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-77
- Updated
- 2026-11-02
EUVDEUVD-2020-6487
It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.
- Record
EUVD-2020-6487- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7mmj-72wg-6gpv
It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password,...
It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.
- Record
GHSA-7mmj-72wg-6gpv- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-78
- Updated
- 2026-11-02
NVD
It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.
- Record
CVE-2020-14342- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.4 Medium
AV:L/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-77, CWE-78
- Updated
- 2026-11-02
OSVALPINE-CVE-2020-14342
It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.
- Record
ALPINE-CVE-2020-14342- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVAZL-6353
CVE-2020-14342 affecting package cifs-utils for versions less than 6.8-6
It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.
- Record
AZL-6353- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 14 moreShow less
OSV
It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.
- Record
CVE-2020-14342- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2020-14342
It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.
- Record
DEBIAN-CVE-2020-14342- CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2020-14342
It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.
- Record
UBUNTU-CVE-2020-14342- CVSS 3.1
- 4.4 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - CVSS 3.1
- 7.0 High
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1792442320 No score
cifs-utils: Fix of CVE-2022-27239
- CVE-2020-14342: mount.cifs shell command injection via username mount option when built with systemd-ask-password support
- Record
CLSA-2026-1792442320- Updated
- 2026-11-02
OSVCLSA-2026-1792442514 No score
cifs-utils: Fix of CVE-2022-27239
- CVE-2020-14342: mount.cifs shell command injection via username mount option when built with systemd-ask-password support
- Record
CLSA-2026-1792442514- Updated
- 2026-11-02
OSVMGASA-2020-0376 No score
Updated cifs-utils packages fix security vulnerability
The mount.cifs utility has a shell injection issue where one can embed shell commands via the username mount option. Those commands will be run via popen() in the context of the user calling mount (CVE-2020-14342).
- Record
MGASA-2020-0376- Updated
- 2026-11-02
OSVopenSUSE-SU-2020:1579-1 No score
Security update for cifs-utils
This update for cifs-utils fixes the following issues:
- CVE-2020-14342: Fixed a shell command injection vulnerability in mount.cifs (bsc#1174477).
- Fixed an invalid free in mount.cifs; (bsc#1152930).
This update was imported from the SUSE:SLE-15-SP1:Update update project.
- Record
openSUSE-SU-2020:1579-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0639-1 No score
Security update for cifs-utils
This update for cifs-utils fixes the following security issues:
- CVE-2021-20208: Fixed a potential kerberos auth leak escaping from container. (bsc#1183239)
- CVE-2020-14342: Fixed a shell command injection vulnerability in mount.cifs. (bsc#1174477)
This update for cifs-utils fixes the following issues:
-
Solve invalid directory mounting. When attempting to change the current working directory into non-existing directories, mount.cifs crashes. (bsc#1152930)
-
Fixed a bug where it was no longer possible to mount CIFS filesystem after the last maintenance update. (bsc#1184815)
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2021:0639-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10683-1 No score
cifs-utils-6.13-1.3 on GA media
These are all security issues fixed in the cifs-utils-6.13-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10683-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:2728-1 No score
Security update for cifs-utils
This update for cifs-utils fixes the following issues:
- CVE-2020-14342: Fixed a shell command injection vulnerability in mount.cifs (bsc#1174477).
- Record
SUSE-SU-2020:2728-1- Updated
- 2026-11-02
OSVSUSE-SU-2020:2729-1 No score
Security update for cifs-utils
This update for cifs-utils fixes the following issues:
- CVE-2020-14342: Fixed a shell command injection vulnerability in mount.cifs (bsc#1174477).
- Fixed an invalid free in mount.cifs; (bsc#1152930).
- Record
SUSE-SU-2020:2729-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:1455-1 No score
Security update for cifs-utils
This update for cifs-utils fixes the following security issues:
- CVE-2021-20208: Fixed a potential kerberos auth leak escaping from container. (bsc#1183239)
- CVE-2020-14342: Fixed a shell command injection vulnerability in mount.cifs. (bsc#1174477)
This update for cifs-utils fixes the following issues:
-
Solve invalid directory mounting. When attempting to change the current working directory into non-existing directories, mount.cifs crashes. (bsc#1152930)
-
Fixed a bug where it was no longer possible to mount CIFS filesystem after the last maintenance update. (bsc#1184815)
- Record
SUSE-SU-2021:1455-1- Updated
- 2026-11-02
OSVUSN-5459-1 No score
cifs-utils vulnerabilities
Aurélien Aptel discovered that cifs-utils invoked a shell when requesting a password. In certain environments, a local attacker could possibly use this issue to escalate privileges. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2020-14342)
It was discovered that cifs-utils incorrectly used host credentials when mounting a krb5 CIFS file system from within a container. An attacker inside a container could possibly use this issue to obtain access to sensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-20208)
It was discovered that cifs-utils incorrectly handled certain command-line arguments. A local attacker could possibly use this issue to obtain root privileges. (CVE-2022-27239)
It was discovered that cifs-utils incorrectly handled verbose logging. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2022-29869)
- Record
USN-5459-1- Updated
- 2026-11-02
OSVUSN-7688-1 No score
cifs-utils vulnerabilities
Aurélien Aptel discovered that cifs-utils invoked a shell when requesting a password. In certain environments, a local attacker could possibly use this issue to escalate privileges. (CVE-2020-14342)
It was discovered that cifs-utils incorrectly used host credentials when mounting a krb5 CIFS file system from within a container. An attacker inside a container could possibly use this issue to obtain access to sensitive information. (CVE-2021-20208)
It was discovered that cifs-utils incorrectly handled certain command-line arguments. A local attacker could possibly use this issue to obtain root privileges. (CVE-2022-27239)
It was discovered that cifs-utils incorrectly handled verbose logging. A local attacker could possibly use this issue to obtain sensitive information. (CVE-2022-29869)
- Record
USN-7688-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cifs-utilsAlpine:v3.11 |
5.6 up to 6.13-r0 | 6.13-r0 |
cifs-utilsAlpine:v3.13 |
5.6 up to 6.11-r0 | 6.11-r0 |
cifs-utilsAzure Linux:2 |
before 6.8-6 | 6.8-6 |
cifs-utilsTuxCare:RHEL:7 From an advisory covering 2 CVEs |
before 6.2-10.el7.0.5.tuxcare.els3 | 6.2-10.el7.0.5.tuxcare.els3 |
cifs-utils-develTuxCare:RHEL:7 From an advisory covering 2 CVEs |
before 6.2-10.el7.0.5.tuxcare.els3 | 6.2-10.el7.0.5.tuxcare.els3 |
cifs-utilsTuxCare:OracleLinux:7 From an advisory covering 2 CVEs |
before 6.2-10.el7.0.5.tuxcare.els3 | 6.2-10.el7.0.5.tuxcare.els3 |
cifs-utils-develTuxCare:OracleLinux:7 From an advisory covering 2 CVEs |
before 6.2-10.el7.0.5.tuxcare.els3 | 6.2-10.el7.0.5.tuxcare.els3 |
cifs-utilsDebian:12 |
before 2:6.11-1 | 2:6.11-1 |
cifs-utilsDebian:13 |
before 2:6.11-1 | 2:6.11-1 |
cifs-utilsDebian:14 |
before 2:6.11-1 | 2:6.11-1 |
Show 22 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cifs-utilsMageia:7 |
before 6.9-6.1.mga7 | 6.9-6.1.mga7 |
cifs-utilsSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 6.9-13.11.1 | 6.9-13.11.1 |
cifs-utilsSUSE:Linux Enterprise Server 12 SP5 |
before 6.9-13.11.1 | 6.9-13.11.1 |
cifs-utilsSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 6.9-13.11.1 | 6.9-13.11.1 |
cifs-utilsSUSE:Linux Enterprise Module for Basesystem 15 SP1 |
before 6.9-5.6.1 | 6.9-5.6.1 |
cifs-utilsSUSE:Linux Enterprise Module for Basesystem 15 SP2 |
before 6.9-5.6.1 | 6.9-5.6.1 |
cifs-utilsSUSE:Linux Enterprise High Performance Computing 15-ESPOS From an advisory covering 2 CVEs |
before 6.9-3.14.1 | 6.9-3.14.1 |
cifs-utilsSUSE:Linux Enterprise High Performance Computing 15-LTSS From an advisory covering 2 CVEs |
before 6.9-3.14.1 | 6.9-3.14.1 |
cifs-utilsSUSE:Linux Enterprise Server 15-LTSS From an advisory covering 2 CVEs |
before 6.9-3.14.1 | 6.9-3.14.1 |
cifs-utilsSUSE:Linux Enterprise Server for SAP Applications 15 From an advisory covering 2 CVEs |
before 6.9-3.14.1 | 6.9-3.14.1 |
cifs-utilsUbuntu:Pro:14.04:LTS |
before 2:6.0-1ubuntu2+esm1, plus listed versions 2:6.0-1ubuntu2 |
2:6.0-1ubuntu2+esm1 |
cifs-utilsUbuntu:Pro:16.04:LTS |
before 2:6.4-1ubuntu1.1+esm1, plus listed versions 2:6.4-1ubuntu12:6.4-1ubuntu1.1 |
2:6.4-1ubuntu1.1+esm1 |
cifs-utilsUbuntu:18.04:LTS |
before 2:6.8-1ubuntu1.2, plus listed versions 2:6.7-12:6.8-12:6.8-1ubuntu12:6.8-1ubuntu1.1 |
2:6.8-1ubuntu1.2 |
cifs-utilsUbuntu:20.04:LTS |
before 2:6.9-1ubuntu0.2, plus listed versions 2:6.9-0ubuntu12:6.9-12:6.9-1ubuntu0.1 |
2:6.9-1ubuntu0.2 |
cifs-utilsUbuntu:18.04:LTS From an advisory covering 4 CVEs |
before 2:6.8-1ubuntu1.2, plus listed versions 2:6.7-12:6.8-12:6.8-1ubuntu12:6.8-1ubuntu1.1 |
2:6.8-1ubuntu1.2 |
cifs-utilsUbuntu:20.04:LTS From an advisory covering 4 CVEs |
before 2:6.9-1ubuntu0.2, plus listed versions 2:6.9-0ubuntu12:6.9-12:6.9-1ubuntu0.1 |
2:6.9-1ubuntu0.2 |
cifs-utilsUbuntu:22.04:LTS From an advisory covering 4 CVEs |
before 2:6.14-1ubuntu0.1, plus listed versions 2:6.11-3.12:6.14-12:6.14-1build1 |
2:6.14-1ubuntu0.1 |
cifs-utilsUbuntu:Pro:14.04:LTS From an advisory covering 4 CVEs |
before 2:6.0-1ubuntu2+esm1, plus listed versions 2:6.0-1ubuntu2 |
2:6.0-1ubuntu2+esm1 |
cifs-utilsUbuntu:Pro:16.04:LTS From an advisory covering 4 CVEs |
before 2:6.4-1ubuntu1.1+esm1, plus listed versions 2:6.4-1ubuntu12:6.4-1ubuntu1.1 |
2:6.4-1ubuntu1.1+esm1 |
cifs-utilsopenSUSE:Leap 15.1 |
before 6.9-lp151.4.7.1 | 6.9-lp151.4.7.1 |
cifs-utilsopenSUSE:Leap 15.2 From an advisory covering 2 CVEs |
before 6.9-lp152.2.3.1 | 6.9-lp152.2.3.1 |
cifs-utilsopenSUSE:Tumbleweed From an advisory covering 16 CVEs |
before 6.13-1.3 | 6.13-1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-14342 is a medium vulnerability (CVSS 4.4) in Cifs-utils, published September 9, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.65%, the 51st percentile. Fixed in cifs-utils 6.13-r0.
References
lists.samba.org/archive/samba-technical/2020-September/135747.html
bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14342
security.gentoo.org/glsa/202009-16
lists.opensuse.org/opensuse-security-announce/2020-09/msg00109.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DUMRICFXJVCBBOSKZSKT3HFVQM6VPJU3
Show 44 moreShow less
nvd.nist.gov/vuln/detail/CVE-2020-14342
github.com/advisories/GHSA-7mmj-72wg-6gpv
security.alpinelinux.org/vuln/CVE-2020-14342
errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1792442320.html
security-tracker.debian.org/tracker/CVE-2020-14342
advisories.mageia.org/MGASA-2020-0376.html
bugs.mageia.org/show_bug.cgi?id=27315
lists.suse.com/pipermail/sle-security-updates/2020-September/007471.html
suse.com/support/update/announcement/2020/suse-su-20202728-1
bugzilla.suse.com/1174477
ubuntu.com/security/CVE-2020-14342
cve.org/CVERecord?id=CVE-2020-14342