CVE-2020-15113

In etcd before versions 3.3.23 and 3.4.10, certain directory paths are created (etcd data directory and the directory path when provided to automatically generate self-signed certificates for TLS connections with clients) with restricted access permissions (700) by using the os.MkdirAll. This function does not perform any permission checks when a given directory path exists already. A possible workaround is to ensure the directories have the desired permission (700).

• CWE-281
• CWE-281

• https://github.com/etcd-io/etcd/security/advisories/GHSA-chh6-ppwq-jh92Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/
• https://github.com/etcd-io/etcd/security/advisories/GHSA-chh6-ppwq-jh92Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L6B6R43Y7M3DCHWK3L3UVGE2K6WWECMP/

Published

Aug 5, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-15108In glpi before 9.5.1, there is a SQL injection for all usage…7.1
• CVE-2020-15109In solidus before versions 2.8.6, 2.9.6, and 2.10.2, there i…5.3
• CVE-2020-1511An elevation of privilege vulnerability exists when Connecte…7.8
• CVE-2020-15110In jupyterhub-kubespawner before 0.12, certain usernames wil…8.1
• CVE-2020-15111In Fiber before version 1.12.6, the filename that is given i…5.4
• CVE-2020-15112In etcd before versions 3.3.23 and 3.4.10, it is possible to…6.5
• CVE-2020-15114In etcd before versions 3.3.23 and 3.4.10, the etcd gateway …7.7
• CVE-2020-15115etcd before versions 3.3.23 and 3.4.10 does not perform any …7.5
• CVE-2020-15117In Synergy before version 1.12.0, a Synergy server can be cr…6.5
• CVE-2020-15118In Wagtail before versions 2.7.4 and 2.9.3, when a form page…5.4
• CVE-2020-15119In auth0-lock versions before and including 11.25.1, dangero…5.4
• CVE-2020-1512An information disclosure vulnerability exists when the Wind…7.8