Privilege Escalation in Pydio Cells Enterprise OVF Version 2.0.4

CVE-2020-12850

What is CVE-2020-12850?

The Pydio Cells Enterprise OVF version 2.0.4 introduces a vulnerability where prior versions had less restrictive access controls. In earlier versions, the 'pydio' user could execute any privileged command using sudo, posing significant security risks. With version 2.0.4, this user has limited privileges, specifically designated to run essential services such as mysqld and others related to the Pydio Cells web application. This change is a critical step toward enhancing security and controlling access to sensitive commands, ensuring that only authorized services operate under well-defined user privileges.

References