A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2025/06/03/8 | Mailing List Third Party Advisory |
| https://access.redhat.com/security/cve/CVE-2025-0620 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=2370453 | Issue Tracking Third Party Advisory |
| https://www.samba.org/samba/security/CVE-2025-0620.html | Vendor Advisory |
Configurations
History
13 Aug 2025, 15:12
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.9 |
| CPE | cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* | |
| First Time |
Samba
Samba samba |
|
| References | () http://www.openwall.com/lists/oss-security/2025/06/03/8 - Mailing List, Third Party Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=2370453 - Issue Tracking, Third Party Advisory | |
| References | () https://access.redhat.com/security/cve/CVE-2025-0620 - Third Party Advisory | |
| References | () https://www.samba.org/samba/security/CVE-2025-0620.html - Vendor Advisory |
06 Jun 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-06-06 14:15
Updated : 2025-08-13 15:12
NVD link : CVE-2025-0620
Mitre link : CVE-2025-0620
JSON object : View
Products Affected
samba
- samba
CWE
CWE-552
Files or Directories Accessible to External Parties