Lucene search

[email protected]CVE-2021-46705

HistoryMar 16, 2022 - 10:15 a.m.

CVE-2021-46705

2022-03-1610:15:08

CWE-377

[email protected]

web.nvd.nist.gov

cve-2021-46705

insecure temporary file

grub2

suse linux enterprise server

opensuse factory

local attackers

5.1 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.6 Medium

AI Score

Confidence

High

2.1 Low

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:L/Au:N/C:N/I:P/A:N

0.0004 Low

EPSS

Percentile

5.2%

JSON

A Insecure Temporary File vulnerability in grub-once of grub2 in SUSE Linux Enterprise Server 15 SP4, openSUSE Factory allows local attackers to truncate arbitrary files. This issue affects: SUSE Linux Enterprise Server 15 SP4 grub2 versions prior to 2.06-150400.7.1. SUSE openSUSE Factory grub2 versions prior to 2.06-18.1.

Affected configurations

NVD

Node

suselinux_enterprise_serverMatch15sp4

AND

gnugrub2Range<2.06-150400.7.1

Node

opensusefactoryMatch-

AND

gnugrub2Range<2.06-18.1

CPENameOperatorVersion
gnu:grub2gnu grub2lt2.06-150400.7.1

CPE	Name	Operator	Version
gnu:grub2	gnu grub2	lt	2.06-150400.7.1

CNA Affected

[
  {
    "product": "SUSE Linux Enterprise Server 15 SP4",
    "vendor": "SUSE",
    "versions": [
      {
        "lessThan": "2.06-150400.7.1",
        "status": "affected",
        "version": "grub2",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "openSUSE Factory",
    "vendor": "SUSE",
    "versions": [
      {
        "lessThan": "2.06-18.1",
        "status": "affected",
        "version": "grub2",
        "versionType": "custom"
      }
    ]
  }
]

References

bugzilla.suse.com/show_bug.cgi?id=1190474

5.1 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.6 Medium

AI Score

Confidence

High

2.1 Low

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:L/Au:N/C:N/I:P/A:N

0.0004 Low

EPSS

Percentile

5.2%

JSON

Related for CVE-2021-46705

cvelist1 nvd1 prion1 debiancve1