VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Oct 26, 2023· Updated Jun 17, 2026

CVE-2020-17477

CVE-2020-17477

Description

Incorrect LDAP ACLs in ucs-school-ldap-acls-master in UCS@school before 4.4v5-errata allow remote teachers, staff, and school administrators to read LDAP password hashes (sambaNTPassword, krb5Key, sambaPasswordHistory, and pwhistory) via LDAP search requests. For example, a teacher can gain administrator access via an NTLM hash.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • Univention/ucs-school-ldap-acls-masterllm-create
    Range: <4.4v5-errata
  • Univention/Ucs\@school2 versions
    cpe:2.3:a:univention:ucs\@school:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:univention:ucs\@school:*:*:*:*:*:*:*:*range: <=4.4
    • (no CPE)range: <4.4v5-errata
  • UCS@school/ucs-school-ldap-acls-masterdescription

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.