{"id":"CVE-2020-25507","aliases":["EUVD-2020-18192","GHSA-66pq-mwg2-mc6q"],"status":"published","title":"An incorrect permission assignment (chmod 777) of /etc/environment during the installation script...","description":"An incorrect permission assignment during the installation script of TeamworkCloud 18.0 thru 19.0 allows a local unprivileged attacker to execute arbitrary code as root. During installation, the user is instructed to set the system enviroment file with world writable permissions (0777 /etc/environment). Any local unprivileged user can execute arbitrary code simply by writing to /etc/environment, which will force all users, including root, to execute arbitrary code during the next login or reboot. In addition, the entire home directory of the twcloud user at /home/twcloud is recursively given world writable permissions. This allows any local unprivileged attacker to execute arbitrary code, as twcloud. This product was previous named Cameo Enterprise Data Warehouse (CEDW).","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00548,"percentile":0.46367,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-732"],"published":"2020-12-28T19:33:43Z","modified":"2026-06-17T03:06:52Z","products":[{"vendor":"3ds","product":"teamwork_cloud"}],"references":[{"url":"https://docs.nomagic.com/display/TWCloud190/Installation+on+Linux+using+scripts","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://github.com/sickcodes/security/blob/master/advisories/SICK-2020-002.md","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://sick.codes/sick-2020-002/","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://community.nomagic.com/finding-and-fixing-wrong-file-permission-twc-installation-t7165.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://sick.codes/finding-a-vulnerability-in-teamwork-cloud-server-nomagic-3ds-which-is-used-by-gov-enterprise-to-design-rockets-missiles-and-satellites","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://web.archive.org/web/20201219155833/https://docs.nomagic.com/pages/viewpage.action?pageId=20846937","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://web.archive.org/web/20201219095507/https://docs.nomagic.com/display/TWCloud185SP1/Installation+on+Centos+7.","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-25507"},{"url":"https://github.com/advisories/GHSA-66pq-mwg2-mc6q"}],"sources":{"cve":[{"id":"CVE-2020-25507","description":"An incorrect permission assignment during the installation script of TeamworkCloud 18.0 thru 19.0 allows a local unprivileged attacker to execute arbitrary code as root. During installation, the user is instructed to set the system enviroment file with world writable permissions (0777 /etc/environment). Any local unprivileged user can execute arbitrary code simply by writing to /etc/environment, which will force all users, including root, to execute arbitrary code during the next login or reboot. In addition, the entire home directory of the twcloud user at /home/twcloud is recursively given world writable permissions. This allows any local unprivileged attacker to execute arbitrary code, as twcloud. This product was previous named Cameo Enterprise Data Warehouse (CEDW).","status":"published","published":"2020-12-28T19:33:43Z","modified":"2024-08-04T15:33:05.749Z","updated_at":"2026-11-02T14:35:48.213211Z"}],"euvd":[{"id":"EUVD-2020-18192","description":"An incorrect permission assignment during the installation script of TeamworkCloud 18.0 thru 19.0 allows a local unprivileged attacker to execute arbitrary code as root. During installation, the user is instructed to set the system enviroment file with world writable permissions (0777 /etc/environment). Any local unprivileged user can execute arbitrary code simply by writing to /etc/environment, which will force all users, including root, to execute arbitrary code during the next login or reboot. In addition, the entire home directory of the twcloud user at /home/twcloud is recursively given world writable permissions. This allows any local unprivileged attacker to execute arbitrary code, as twcloud. This product was previous named Cameo Enterprise Data Warehouse (CEDW).","status":"published","published":"2020-12-28T19:33:43Z","modified":"2024-08-04T15:33:05Z","updated_at":"2026-11-03T03:07:17.764085Z"}],"ghsa":[{"id":"GHSA-66pq-mwg2-mc6q","title":"An incorrect permission assignment (chmod 777) of /etc/environment during the installation script...","description":"An incorrect permission assignment (chmod 777) of /etc/environment during the installation script of No Magic TeamworkCloud 18.0 through 19.0 allows any local unprivileged user to write to /etc/environment. An attacker can escalate to root by writing arbitrary code to this file, which would be executed by root during the next login, reboot, or sourcing of the environment.","status":"published","published":"2022-05-24T17:37:23Z","modified":"2023-01-29T05:04:51Z","cwes":["CWE-732"],"updated_at":"2026-11-02T14:45:39.24589Z"}],"nvd":[{"id":"CVE-2020-25507","description":"An incorrect permission assignment during the installation script of TeamworkCloud 18.0 thru 19.0 allows a local unprivileged attacker to execute arbitrary code as root. During installation, the user is instructed to set the system enviroment file with world writable permissions (0777 /etc/environment). Any local unprivileged user can execute arbitrary code simply by writing to /etc/environment, which will force all users, including root, to execute arbitrary code during the next login or reboot. In addition, the entire home directory of the twcloud user at /home/twcloud is recursively given world writable permissions. This allows any local unprivileged attacker to execute arbitrary code, as twcloud. This product was previous named Cameo Enterprise Data Warehouse (CEDW).","status":"published","published":"2020-12-28T20:15:12.447Z","modified":"2026-06-17T03:06:52.737Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:06:28.340168Z"}]}}