Lucene search

[email protected]CVE-2019-3693

HistoryJan 24, 2020 - 10:15 a.m.

CVE-2019-3693

2020-01-2410:15:12

CWE-59

[email protected]

web.nvd.nist.gov

102

cve

2019

3693

symlink

vulnerability

mailman

suse linux

privilege escalation

nvd

opensuse leap 15.1

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed local attackers to escalate their privileges from user wwwrun to root. Additionally arbitrary files could be changed to group mailman. This issue affects: SUSE Linux Enterprise Server 11 mailman versions prior to 2.1.15-9.6.15.1. SUSE Linux Enterprise Server 12 mailman versions prior to 2.1.17-3.11.1. openSUSE Leap 15.1 mailman version 2.1.29-lp151.2.14 and prior versions.

Affected configurations

NVD

Node

susemailmanRange<2.1.15-9.6.15.1

AND

suselinux_enterprise_serverMatch11-

Node

susemailmanRange<2.1.17-3.11.1

AND

suselinux_enterprise_serverMatch12-

Node

susemailmanRange≤2.1.29-lp151.2.14

AND

opensuseleapMatch15.1

Node

opensusebackports_sleMatch15.0sp1

CPENameOperatorVersion
suse:mailmansuse mailmanlt2.1.15-9.6.15.1

CPE	Name	Operator	Version
suse:mailman	suse mailman	lt	2.1.15-9.6.15.1

CNA Affected

[
  {
    "product": "SUSE Linux Enterprise Server 11",
    "vendor": "SUSE",
    "versions": [
      {
        "lessThan": "2.1.15-9.6.15.1",
        "status": "affected",
        "version": "mailman",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "SUSE Linux Enterprise Server 12",
    "vendor": "SUSE",
    "versions": [
      {
        "lessThan": "2.1.17-3.11.1",
        "status": "affected",
        "version": "mailman",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Leap 15.1",
    "vendor": "openSUSE",
    "versions": [
      {
        "lessThanOrEqual": "2.1.29-lp151.2.14",
        "status": "affected",
        "version": "mailman",
        "versionType": "custom"
      }
    ]
  }
]

References

lists.opensuse.org/opensuse-security-announce/2020-01/msg00059.html

lists.opensuse.org/opensuse-security-announce/2020-02/msg00000.html

bugzilla.suse.com/show_bug.cgi?id=1154328

Social References

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

7.4 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

Related for CVE-2019-3693

nessus3 cvelist1 openvas3 suse2 prion1 nvd1