{"id":"CVE-2020-15861","aliases":["DEBIAN-CVE-2020-15861","DLA-2313-1","DSA-4746-1","EUVD-2020-7842","GHSA-mfrp-422x-34qv","UBUNTU-CVE-2020-15861","USN-4471-1"],"status":"published","title":"Net-SNMP through 5.7.3 allows Escalation of Privileges because of UNIX symbolic link (symlink)...","description":"Net-SNMP through 5.7.3 allows Escalation of Privileges because of UNIX symbolic link (symlink) following.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00455,"percentile":0.39961,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59"],"published":"2020-08-04T00:00:00Z","modified":"2026-10-26T12:00:43Z","fixes":[{"ecosystem":"Debian:12","package":"net-snmp","fixed_in":["5.8+dfsg-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"net-snmp","fixed_in":["5.8+dfsg-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"net-snmp","fixed_in":["5.8+dfsg-5"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"net-snmp","fixed_in":["5.7.3+dfsg-1.7+deb9u3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"net-snmp","fixed_in":["5.7.2~dfsg-8.1ubuntu3.3+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"net-snmp","fixed_in":["5.7.3+dfsg-1ubuntu4.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"net-snmp","fixed_in":["5.7.3+dfsg-1.8ubuntu3.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"net-snmp","fixed_in":["5.8+dfsg-2ubuntu2.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8+dfsg-5"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7.3+dfsg-1.7+deb9u3"}]}],"versions":["5.7.3+dfsg-1.7","5.7.3+dfsg-1.7+deb9u1","5.7.3+dfsg-1.7+deb9u2"]},{"source":"osv","ecosystem":"Debian:10","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7.3+dfsg-5+deb10u1"}]}],"versions":["5.7.3+dfsg-5"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7.2~dfsg-8.1ubuntu3.3+esm1"}]}],"versions":["5.7.2~dfsg-8ubuntu1","5.7.2~dfsg-8ubuntu2","5.7.2~dfsg-8.1ubuntu1","5.7.2~dfsg-8.1ubuntu2","5.7.2~dfsg-8.1ubuntu3","5.7.2~dfsg-8.1ubuntu3.1","5.7.2~dfsg-8.1ubuntu3.2","5.7.2~dfsg-8.1ubuntu3.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7.3+dfsg-1ubuntu4.5"}]}],"versions":["5.7.3+dfsg-1ubuntu2","5.7.3+dfsg-1ubuntu3","5.7.3+dfsg-1ubuntu4","5.7.3+dfsg-1ubuntu4.1","5.7.3+dfsg-1ubuntu4.2","5.7.3+dfsg-1ubuntu4.3","5.7.3+dfsg-1ubuntu4.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7.3+dfsg-1.8ubuntu3.5"}]}],"versions":["5.7.3+dfsg-1.7ubuntu1","5.7.3+dfsg-1.8ubuntu1","5.7.3+dfsg-1.8ubuntu2","5.7.3+dfsg-1.8ubuntu3","5.7.3+dfsg-1.8ubuntu3.1","5.7.3+dfsg-1.8ubuntu3.2","5.7.3+dfsg-1.8ubuntu3.3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8+dfsg-2ubuntu2.3"}]}],"versions":["5.7.3+dfsg-5ubuntu5","5.7.3+dfsg-5ubuntu6","5.8+dfsg-2ubuntu1","5.8+dfsg-2ubuntu2","5.8+dfsg-2ubuntu2.1","5.8+dfsg-2ubuntu2.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7.2~dfsg-8.1ubuntu3.3+esm1"}]}],"versions":["5.7.2~dfsg-8ubuntu1","5.7.2~dfsg-8ubuntu2","5.7.2~dfsg-8.1ubuntu1","5.7.2~dfsg-8.1ubuntu2","5.7.2~dfsg-8.1ubuntu3","5.7.2~dfsg-8.1ubuntu3.1","5.7.2~dfsg-8.1ubuntu3.2","5.7.2~dfsg-8.1ubuntu3.3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7.3+dfsg-1ubuntu4.5"}]}],"versions":["5.7.3+dfsg-1ubuntu2","5.7.3+dfsg-1ubuntu3","5.7.3+dfsg-1ubuntu4","5.7.3+dfsg-1ubuntu4.1","5.7.3+dfsg-1ubuntu4.2","5.7.3+dfsg-1ubuntu4.3","5.7.3+dfsg-1ubuntu4.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.7.3+dfsg-1.8ubuntu3.5"}]}],"versions":["5.7.3+dfsg-1.7ubuntu1","5.7.3+dfsg-1.8ubuntu1","5.7.3+dfsg-1.8ubuntu2","5.7.3+dfsg-1.8ubuntu3","5.7.3+dfsg-1.8ubuntu3.1","5.7.3+dfsg-1.8ubuntu3.2","5.7.3+dfsg-1.8ubuntu3.3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"net-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8+dfsg-2ubuntu2.3"}]}],"versions":["5.7.3+dfsg-5ubuntu5","5.7.3+dfsg-5ubuntu6","5.8+dfsg-2ubuntu1","5.8+dfsg-2ubuntu2","5.8+dfsg-2ubuntu2.1","5.8+dfsg-2ubuntu2.2"],"bundled":2}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"net-snmp","product":"net-snmp"},{"vendor":"netapp","product":"cloud_backup"},{"vendor":"netapp","product":"smi-s_provider"},{"vendor":"netapp","product":"solidfire_\\\u0026_hci_management_node"}],"references":[{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=966599","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/net-snmp/net-snmp/commit/4fd9a450444a434a993bc72f7c3486ccce41f602","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/net-snmp/net-snmp/issues/145","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/202008-12","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4471-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20200904-0001/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-15861"},{"url":"https://security.netapp.com/advisory/ntap-20200904-0001"},{"url":"https://usn.ubuntu.com/4471-1"},{"url":"https://github.com/advisories/GHSA-mfrp-422x-34qv"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-15861","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-15861","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4471-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-15861","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-15862","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-15861","description":"Net-SNMP through 5.7.3 allows Escalation of Privileges because of UNIX symbolic link (symlink) following.","status":"published","published":"2020-08-19T18:28:30Z","modified":"2025-12-03T18:23:52.736Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:35:49.879248Z"}],"euvd":[{"id":"EUVD-2020-7842","description":"Net-SNMP through 5.7.3 allows Escalation of Privileges because of UNIX symbolic link (symlink) following.","status":"published","published":"2020-08-19T18:28:30Z","modified":"2025-12-03T18:23:52Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:10.321316Z"}],"ghsa":[{"id":"GHSA-mfrp-422x-34qv","title":"Net-SNMP through 5.7.3 allows Escalation of Privileges because of UNIX symbolic link (symlink)...","description":"Net-SNMP through 5.7.3 allows Escalation of Privileges because of UNIX symbolic link (symlink) following.","status":"published","published":"2022-05-24T17:26:14Z","modified":"2025-12-03T21:32:02Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T15:05:02.442862Z"}],"nvd":[{"id":"CVE-2020-15861","description":"Net-SNMP through 5.7.3 allows Escalation of Privileges because of UNIX symbolic link (symlink) following.","status":"published","published":"2020-08-20T01:17:13.837Z","modified":"2026-06-17T02:57:18.58Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-59"],"updated_at":"2026-11-02T14:06:13.05572Z"}],"osv":[{"id":"CVE-2020-15861","description":"Net-SNMP through 5.7.3 allows Escalation of Privileges because of UNIX symbolic link (symlink) following.","status":"published","published":"2020-08-20T01:17:13.837Z","modified":"2026-10-20T13:51:59.738644174Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:14.828228Z"},{"id":"DEBIAN-CVE-2020-15861","description":"Net-SNMP through 5.7.3 allows Escalation of Privileges because of UNIX symbolic link (symlink) following.","status":"published","published":"2020-08-20T01:17:13.837Z","modified":"2026-10-26T12:00:43.098108849Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:33.384087Z"},{"id":"UBUNTU-CVE-2020-15861","description":"Net-SNMP through 5.7.3 allows Escalation of Privileges because of UNIX symbolic link (symlink) following.","status":"published","published":"2020-08-06T00:00:00Z","modified":"2026-04-22T12:31:12.499103Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:23.344108Z"},{"id":"DLA-2313-1","title":"net-snmp - security update","status":"published","published":"2020-08-04T00:00:00Z","modified":"2026-03-09T01:23:08.931357Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-4746-1","title":"net-snmp - security update","status":"published","published":"2020-08-15T00:00:00Z","modified":"2026-03-09T02:09:40.840989Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"USN-4471-1","title":"net-snmp vulnerabilities","description":"Tobias Neitzel discovered that Net-SNMP incorrectly handled certain symlinks.\nAn attacker could possibly use this issue to access sensitive information.\n(CVE-2020-15861)\n\nIt was discovered that Net-SNMP incorrectly handled certain inputs.\nAn attacker could possibly use this issue to execute arbitrary code.\nThis issue only affected Ubuntu 14.04 ESM, Ubuntu 16.04 LTS, Ubuntu\n18.04 LTS, and Ubuntu 20.04 LTS. (CVE-2020-15862)\n","status":"published","published":"2020-08-24T16:09:50Z","modified":"2026-04-22T10:07:08.54614Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}