CVE-2021-20001

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-02-11 · updated 2026-06-17
Weakness: CWE-276

Description

It was discovered, that debian-edu-config, a set of configuration files used for the Debian Edu blend, before 2.12.16 configured insecure permissions for the user web shares (~/public_html), which could result in privilege escalation.

Affected products

Debian Linux: 9.0, 10.0, 11.0
Skolelinux Debian-Edu-Config: before 2.12.16 — fixed in 2.12.16

How to fix

Upgrade to a fixed version: Skolelinux Debian-Edu-Config 2.12.16. Check the vendor advisory for mitigations.

References

https://lists.debian.org/debian-lts-announce/2022/02/msg00012.html
https://lists.debian.org/debian-security-announce/2022/msg00039.html
https://salsa.debian.org/debian-edu/debian-edu-config/-/commit/4d39a5888d193567704238f8c035f8d17cfe34e5
https://www.debian.org/security/2022/dsa-5072
https://lists.debian.org/debian-lts-announce/2022/02/msg00012.html
https://lists.debian.org/debian-security-announce/2022/msg00039.html
https://salsa.debian.org/debian-edu/debian-edu-config/-/commit/4d39a5888d193567704238f8c035f8d17cfe34e5
https://www.debian.org/security/2022/dsa-5072

Get alerted when CVE-2021-20001 or the next vulnerability affects your stack