CVE-2020-2944 — Vulnerability in the Oracle Solaris product of Oracle Systems (component: Common Desktop Environment)

Back Back to CVE browser

HIGH

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Common Desktop Environment)

Published Apr 15, 2020

8.8

HIGH

CVSS 3.1

EPSS 1.80%

Description

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Common Desktop Environment). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.0 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

Affected products

Vendor Oracle Corporation Product Solaris Operating System Default
n/a
- Version
  10
  Status
  affected
  Constraints
  -
- Version
  11
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Oracle Corporation

Solaris Operating System

n/a

Version	Status	Constraints
10	affected	-
11	affected	-

Remediation

No remediation recorded yet.

Metrics

1.80% 0.01802

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.01802

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v4
EPSS v5

Table of values (17 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	1.80% (0.01802)	77.76th	v5 (v2026.06.15)
Jun 15, 2026	1.80% (0.01802)	75.60th	v5 (v2026.06.15)
Jul 13, 2025	1.01% (0.01009)	76.13th	v4 (v2025.03.14)
Jul 4, 2025	5.33% (0.05334)	89.59th	v4 (v2025.03.14)
Mar 30, 2025	0.66% (0.00662)	68.78th	v4 (v2025.03.14)
Mar 29, 2025	2.19% (0.02194)	73.95th	v4 (v2025.03.14)
Mar 17, 2025	0.71% (0.00706)	70.48th	v4 (v2025.03.14)
Dec 12, 2024	0.10% (0.00101)	43.11th	v3 (v2023.03.01)
Jul 10, 2024	0.10% (0.00101)	41.90th	v3 (v2023.03.01)
Mar 7, 2023	0.10% (0.00101)	39.84th	v3 (v2023.03.01)
Mar 6, 2023	2.00% (0.02001)	79.29th	v2 (v2022.01.01)
Apr 1, 2022	2.00% (0.02001)	77.45th	v2 (v2022.01.01)
Feb 4, 2022	2.20% (0.02198)	57.98th	v2 (v2022.01.01)
Feb 3, 2022	4.50% (0.04504)	76.47th	v1
Jan 6, 2022	4.50% (0.04504)	76.26th	v1
Sep 1, 2021	4.50% (0.04504)	84.13th	v1
Apr 14, 2021	4.50% (0.04504)	0.00th	v1

Weaknesses (1)

CWE-120

Classic Buffer Overflow

References (4)

http://packetstormsecurity.com/files/157280/Common-Desktop-Environment-1.6-Local-Privilege-Escalation.html
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2020/Apr/25
mailing-listx_refsource_FULLDISCMailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2020/04/15/3
mailing-listx_refsource_MLISTExploitMailing ListThird Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html
x_refsource_MISCPatchVendor Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/157280/Common-Desktop-Environment-1.6-Local-Privilege-Escalation.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2020/Apr/25		mailing-listx_refsource_FULLDISCMailing ListThird Party Advisory
http://www.openwall.com/lists/oss-security/2020/04/15/3		mailing-listx_refsource_MLISTExploitMailing ListThird Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html		x_refsource_MISCPatchVendor Advisory