CVE-2018-1122CWE-829

procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top

High · published May 23, 2018

CVSS v3.0
7.3
EPSS
1%
Percentile
69.7
In the wild
Unconfirmed
What it is

procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vulnerabilities in the config_file() function.

The record
Technical detail
CVSS v3.0
7.3 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01273 · 69.7th percentile
Weakness
CWE-829 · Inclusion of Functionality from Untrusted Control Sphere
Published
2018-05-23T14:00Z
EPSS history
Timeline
  • 23 MAY 14:00Z
    procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top
    cvelistv5