CVE-2020-16121
LOWCVSS 3.3/10EPSS 0.46%
Last modified
CVE-2020-16121 is a low-severity vulnerability rated 3.3/10 on the CVSS scale. PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own.. EPSS estimates a 0.46% chance of exploitation in the next 30 days.
Description
PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Packagekit Project | Packagekit | All versions |
| Canonical | Ubuntu Linux | 20.04 |
References
- https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1888887Issue Tracking, Third Party Advisory
- https://www.eyecontrol.nl/blog/the-story-of-3-cves-in-ubuntu-desktop.htmlExploit, Third Party Advisory
- https://bugs.launchpad.net/ubuntu/+source/packagekit/+bug/1888887Issue Tracking, Third Party Advisory
- https://www.eyecontrol.nl/blog/the-story-of-3-cves-in-ubuntu-desktop.htmlExploit, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-16121?
PackageKit provided detailed error messages to unprivileged callers that exposed information about file presence and mimetype of files that the user would be unable to determine on its own.
How severe is CVE-2020-16121?
CVE-2020-16121 has a CVSS score of 3.3/10 (LOW severity). The EPSS model estimates a 0.46% probability of exploitation in the next 30 days.
How do I fix CVE-2020-16121?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-16115Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2020-16116In kerfuffle/jobs.cpp in KDE Ark before 20.08.0, a crafted a…3.3
- CVE-2020-16117In GNOME evolution-data-server before 3.35.91, a malicious s…5.9
- CVE-2020-16118In GNOME Balsa before 2.6.0, a malicious server operator or …7.5
- CVE-2020-16119Use-after-free vulnerability in the Linux kernel exploitable…7.8
- CVE-2020-16120Overlayfs did not properly perform permission checking when …4.4
- CVE-2020-16122PackageKit's apt backend mistakenly treated all local debs a…7.8
- CVE-2020-16123An Ubuntu-specific patch in PulseAudio created a race condit…4.7
- CVE-2020-16124Integer Overflow or Wraparound vulnerability in the XML RPC …9.8
- CVE-2020-16125gdm3 versions before 3.36.2 or 3.38.2 would start gnome-init…6.8
- CVE-2020-16126An Ubuntu-specific modification to AccountsService in versio…3.3
- CVE-2020-16127An Ubuntu-specific modification to AccountsService in versio…5.5
Are you affected by CVE-2020-16121?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST