CVE-2020-14196 Missing authorization in n/a
Attackers can bypass access controls to reach the internal web server in PowerDNS Recursor, potentially exposing administrative interfaces.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-14196?
CVE-2020-14196 is a medium-severity missing authorization vulnerability in Powerdns Recursor, published on 1 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In PowerDNS Recursor versions up to and including 4.3.1, 4.2.2 and 4.1.16, the ACL restricting access to the internal web server is not properly enforced.
Weakness: CWE-863
Which versions are affected by CVE-2020-14196?
It affects 1 product.
Linux distribution packages (6)
pdns-recursor SUSE:Package Hub 12 SP1 | All versions | 4.1.12-bp151.4.6.1 |
pdns-recursor SUSE:Package Hub 15 SP1 | All versions | 4.1.12-bp151.4.6.1 |
pdns-recursor SUSE:Package Hub 15 SP2 | All versions | 4.1.12-bp152.2.4.1 |
pdns-recursor SUSE:Package Hub 15 SP2 | All versions | 4.3.2-bp152.2.8.1 |
pdns-recursor openSUSE:Leap 15.1 | All versions | 4.1.12-bp151.4.6.1 |
pdns-recursor openSUSE:Leap 15.2 | All versions | 4.1.12-bp151.4.6.1 |
Products include Powerdns Recursor.
How do I fix CVE-2020-14196?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-14196 being exploited?
There is no known exploitation of CVE-2020-14196 in the wild and no public exploit code.
Other vulnerabilities in Powerdns Recursor
- CVE-2009-4009 Memory corruption in n/a
- CVE-2020-10030 Memory corruption in n/a
- CVE-2025-59023 Crafted delegations or IP fragments can poison cached delegations in Recursor
- CVE-2025-59030 Insufficient validation of incoming notifies over TCP can lead to a denial of service in Recursor
- CVE-2023-22617 Denial of service in n/a
Sources
Also known as DEBIAN-CVE-2020-14196, GHSA-fqf5-f2p3-h3j2, MGASA-2020-0286, UBUNTU-CVE-2020-14196, openSUSE-SU-2020:1005-1, openSUSE-SU-2020:1055-1 and 1 more.