How severe is CVE-2020-8632?

CVE-2020-8632 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2020-8632 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (29th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-8632?

CVE-2020-8632 primarily affects Canonical Cloud-init. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2020-8632?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2020-8632 published?

CVE-2020-8632 was published on 2020-02-05 and last updated on 2026-06-17.

CVE-2020-8632

CVE-2020-8632 is a medium-severity vulnerability in Canonical Cloud-init with a CVSS 3.x base score of 5.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-521.

Key facts

Severity: Medium (CVSS 3.x base score 5.5)
CVSS v2: 2.1
EPSS exploit prediction: 0% (29th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-521
Affected product: Canonical Cloud-init
Published: 2020-02-05
Last modified: 2026-06-17

Description

In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to guess passwords.

Frequently asked questions

What is CVE-2020-8632?: In cloud-init through 19.4, rand_user_password in cloudinit/config/cc_set_passwords.py has a small default pwlen value, which makes it easier for attackers to guess passwords.
How severe is CVE-2020-8632?: CVE-2020-8632 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2020-8632 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (29th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-8632?: CVE-2020-8632 primarily affects Canonical Cloud-init. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2020-8632?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2020-8632 published?: CVE-2020-8632 was published on 2020-02-05 and last updated on 2026-06-17.

References

Affected products (3)

cpe:2.3:a:canonical:cloud-init:*:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

More vulnerabilities in Canonical Cloud-init

CVE-2024-6174 — High (CVSS 8.8): When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address. To…
CVE-2012-6639 — High (CVSS 8.8): An privilege elevation vulnerability exists in Cloud-init before 0.7.0 when requests to an untrusted system are…
CVE-2018-10896 — High (CVSS 7.1): The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling…
CVE-2024-11584 — Medium (CVSS 5.9): cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that…
CVE-2023-1786 — Medium (CVSS 5.5): Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to…
CVE-2022-2084 — Medium (CVSS 5.5): Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are…

All CVEs affecting Canonical Cloud-init →

Other CWE-521 (Weak Password Requirements) vulnerabilities

CVE-2026-25715 — Critical (CVSS 9.8): The web management interface of the device allows the administrator username and password to be set to blank values.…
CVE-2025-53963 — Critical (CVSS 9.8): An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. They run an SSH server accessible…
CVE-2025-63747 — Critical (CVSS 9.8): QaTraq 6.9.2 ships with administrative account credentials which are enabled in default installations and permit…
CVE-2025-12552 — Critical (CVSS 9.8): Insufficient Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.
CVE-2025-11200 — Critical (CVSS 9.8): MLflow Weak Password Requirements Authentication Bypass Vulnerability. This vulnerability allows remote attackers to…
CVE-2025-12364 — Critical (CVSS 9.8): Weak Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.

Browse all CWE-521 (Weak Password Requirements) vulnerabilities →