CVE-2020-28169

The td-agent-builder plugin before 2020-12-18 for Fluentd allows attackers to gain privileges because the bin directory is writable by a user account, but a file in bin is executed as NT AUTHORITY\SYSTEM.

CVSS v3.1 NVD

7.0 HIGHCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

6.9 MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C

EPSS

1.17% chance of exploitation in the next 30 days, 67th percentile

Published

2020-12-24

Updated

2024-08-04

Proof-of-concept exploits (3)

• http://packetstormsecurity.com/files/160791/Fluentd-TD-agent-4.0.1-Insecure-Folder-Permis…
• fluent/fluentd/issues/320113606★ · 2026-10-14
• zubrahzz/FluentD-TD-agent-Exploit-CVE-2020-281690★ · 2020-12-24

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/49363

Security advisories

• https://docs.fluentd.org/installation/install-by-msi
• https://www.fluentd.org
• fluent-plugins-nursery/td-agent-builder/pull/247/commits/6f9cb6393392d62caa99907c0ebbcbab…
• kenhys/td-agent-builder/commit/eec6e2dedf12f2e0c01c2bbe7b8c15b639b3b938
• https://td-agent-package-browser.herokuapp.com/4/windows
• https://www.debian.org/security/2021/dsa-4949

References

• CVE Record
• NVD entry