CVE-2019-18901 mysql-systemd-helper allows setting 640 permissions of arbitrary files

2020-03-0216:10:13

CWE-59

suse

www.cve.org

CVSS3

5.1

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

AI Score

5.3

Confidence

High

EPSS

Percentile

5.1%

JSON

A UNIX Symbolic Link (Symlink) Following vulnerability in the mysql-systemd-helper of the mariadb packaging of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows local attackers to change the permissions of arbitrary files to 0640. This issue affects: SUSE Linux Enterprise Server 12 mariadb versions prior to 10.2.31-3.25.1. SUSE Linux Enterprise Server 15 mariadb versions prior to 10.2.31-3.26.1.

CNA Affected

[
  {
    "product": "SUSE Linux Enterprise Server 12",
    "vendor": "SUSE",
    "versions": [
      {
        "lessThan": "10.2.31-3.25.1",
        "status": "affected",
        "version": "mariadb",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "SUSE Linux Enterprise Server 15",
    "vendor": "SUSE",
    "versions": [
      {
        "lessThan": "10.2.31-3.26.1",
        "status": "affected",
        "version": "mariadb",
        "versionType": "custom"
      }
    ]
  }
]