Filtered by vendor 3ds Subscriptions
Filtered by product Teamwork Cloud Subscriptions
Total 1 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2020-25507 1 3ds 1 Teamwork Cloud 2021-01-04 7.8 High
An incorrect permission assignment during the installation script of TeamworkCloud 18.0 thru 19.0 allows a local unprivileged attacker to execute arbitrary code as root. During installation, the user is instructed to set the system enviroment file with world writable permissions (0777 /etc/environment). Any local unprivileged user can execute arbitrary code simply by writing to /etc/environment, which will force all users, including root, to execute arbitrary code during the next login or reboot. In addition, the entire home directory of the twcloud user at /home/twcloud is recursively given world writable permissions. This allows any local unprivileged attacker to execute arbitrary code, as twcloud. This product was previous named Cameo Enterprise Data Warehouse (CEDW).