VULNERABILITY INTELLIGENCE

CVE-2020-17049

CVSS score6.6 MEDIUM
EPSS probability13.79%
CISA KEVNot currently listed
Published2020-11-11
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD). To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it. The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.

Weakness classification

  • nvd@nist.gov: CWE-863

Primary references