CVE-2020-8026 inn: non-root owned files

2020-07-2400:00:00

CWE-276

suse

www.cve.org

8.4 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

A Incorrect Default Permissions vulnerability in the packaging of inn in openSUSE Leap 15.2, openSUSE Tumbleweed, openSUSE Leap 15.1 allows local attackers with control of the new user to escalate their privileges to root. This issue affects: openSUSE Leap 15.2 inn version 2.6.2-lp152.1.26 and prior versions. openSUSE Tumbleweed inn version 2.6.2-4.2 and prior versions. openSUSE Leap 15.1 inn version 2.5.4-lp151.3.3.1 and prior versions.

CNA Affected

[
  {
    "product": "openSUSE Leap 15.2",
    "vendor": "openSUSE",
    "versions": [
      {
        "lessThanOrEqual": "2.6.2-lp152.1.26",
        "status": "affected",
        "version": "inn",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "openSUSE Tumbleweed",
    "vendor": "openSUSE",
    "versions": [
      {
        "lessThanOrEqual": "2.6.2-4.2",
        "status": "affected",
        "version": "inn",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "openSUSE Leap 15.1",
    "vendor": "openSUSE",
    "versions": [
      {
        "lessThanOrEqual": "2.5.4-lp151.3.3.1",
        "status": "affected",
        "version": "inn",
        "versionType": "custom"
      }
    ]
  }
]