Lucene search

[email protected]NVD:CVE-2019-3696

HistoryMar 03, 2020 - 11:15 a.m.

CVE-2019-3696

2020-03-0311:15:11

CWE-22

[email protected]

web.nvd.nist.gov

CVSS2

4.4

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

AI Score

8.1

Confidence

High

EPSS

Percentile

9.9%

JSON

A Improper Limitation of a Pathname to a Restricted Directory vulnerability in the packaging of pcp of SUSE Linux Enterprise High Performance Computing 15-ESPOS, SUSE Linux Enterprise High Performance Computing 15-LTSS, SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Module for Development Tools 15-SP1, SUSE Linux Enterprise Module for Open Buildservice Development Tools 15, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP5; openSUSE Leap 15.1 allows local user pcp to overwrite arbitrary files with arbitrary content. This issue affects: SUSE Linux Enterprise High Performance Computing 15-ESPOS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise High Performance Computing 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Module for Development Tools 15-SP1 pcp versions prior to 4.3.1-3.5.3. SUSE Linux Enterprise Module for Open Buildservice Development Tools 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server 15-LTSS pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Server for SAP 15 pcp versions prior to 3.11.9-5.8.1. SUSE Linux Enterprise Software Development Kit 12-SP4 pcp versions prior to 3.11.9-6.14.1. SUSE Linux Enterprise Software Development Kit 12-SP5 pcp versions prior to 3.11.9-6.14.1. openSUSE Leap 15.1 pcp versions prior to 4.3.1-lp151.2.3.1.

Affected configurations

Nvd

Node

opensusepcpRange<3.11.9-5.8.1

AND

suselinux_enterprise_high_performance_computingMatch15.0espos

suselinux_enterprise_high_performance_computingMatch15.0ltss

suselinux_enterprise_serverMatch15

suselinux_enterprise_serverMatch15ltss

suselinux_enterprise_serverMatch15sap

Node

opensusepcpRange<4.3.1-3.5.3

AND

suselinux_enterprise_serverMatch15sp1

Node

opensusepcpRange<3.11.9-6.14.1

AND

suselinux_enterprise_software_development_kitMatch12sp4

suselinux_enterprise_software_development_kitMatch12sp5

Node

opensusepcpRange<4.3.1-lp151.2.3.1

AND

opensuseleapMatch15.1

VendorProductVersionCPE
opensusepcp*cpe:2.3:a:opensuse:pcp:*:*:*:*:*:*:*:*
suselinux_enterprise_high_performance_computing15.0cpe:2.3:a:suse:linux_enterprise_high_performance_computing:15.0:*:*:*:espos:*:*:*
suselinux_enterprise_high_performance_computing15.0cpe:2.3:a:suse:linux_enterprise_high_performance_computing:15.0:*:*:*:ltss:*:*:*
suselinux_enterprise_server15cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:*:*:*
suselinux_enterprise_server15cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:ltss:*:*
suselinux_enterprise_server15cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:*:sap:*:*
suselinux_enterprise_server15cpe:2.3:o:suse:linux_enterprise_server:15:sp1:*:*:*:*:*:*
suselinux_enterprise_software_development_kit12cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp4:*:*:*:*:*:*
suselinux_enterprise_software_development_kit12cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp5:*:*:*:*:*:*
opensuseleap15.1cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
opensuse	pcp	*	cpe:2.3:a:opensuse:pcp::::::::
suse	linux_enterprise_high_performance_computing	15.0	cpe:2.3:a:suse:linux_enterprise_high_performance_computing:15.0::::espos:::
suse	linux_enterprise_high_performance_computing	15.0	cpe:2.3:a:suse:linux_enterprise_high_performance_computing:15.0::::ltss:::
suse	linux_enterprise_server	15	cpe:2.3:o:suse:linux_enterprise_server:15:::::::*
suse	linux_enterprise_server	15	cpe:2.3:o:suse:linux_enterprise_server:15:::::ltss::
suse	linux_enterprise_server	15	cpe:2.3:o:suse:linux_enterprise_server:15:::::sap::
suse	linux_enterprise_server	15	cpe:2.3:o:suse:linux_enterprise_server:15:sp1::::::
suse	linux_enterprise_software_development_kit	12	cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp4::::::
suse	linux_enterprise_software_development_kit	12	cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp5::::::
opensuse	leap	15.1	cpe:2.3:o:opensuse:leap:15.1:::::::*