CVE-2020-12850: 
NixOS vulnerability analysis and mitigation

The vulnerability (CVE-2020-12850) affects Pydio Cells Enterprise OVF version 2.0.4. Prior versions of the Pydio Cells Enterprise OVF (such as version 2.0.3) had a looser policy restriction allowing the "pydio" user to execute any privileged command using sudo. In version 2.0.4, the user pydio is responsible for running all the services and binaries contained in the Pydio Cells web application package, such as mysqld, cells, and others, with privileges restricted to running those services only (NVD).

The vulnerability is related to improper privilege management (CWE-269). The CVSS v3.1 base score is 7.0 (HIGH) with vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. The issue specifically concerns the sudo privileges configuration for the pydio user in version 2.0.4 of the Pydio Cells Enterprise OVF (NVD).

The vulnerability could allow a local attacker with pydio user access to execute privileged commands and potentially escalate privileges on the system (CoreSecurity).

The vulnerability requires local access and low privileges (the pydio user account) to exploit. The attack complexity is considered high according to the CVSS score (NVD).

The vulnerability has been addressed in later versions of Pydio Cells. Users should upgrade to a version newer than 2.0.4 to mitigate this security issue (CoreSecurity).