CVE-2019-3691CWE-59

Local privilege escalation from user munge to root

High · published January 23, 2020

CVSS v3.1
7.7
EPSS
1%
Percentile
43.2
In the wild
Unconfirmed
What it is

A Symbolic Link (Symlink) Following vulnerability in the packaging of munge in SUSE Linux Enterprise Server 15; openSUSE Factory allowed local attackers to escalate privileges from user munge to root. This issue affects: SUSE Linux Enterprise Server 15 munge versions prior to 0.5.13-4.3.1. openSUSE Factory munge versions prior to 0.5.13-6.1.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00519 · 43.2th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2020-01-23T16:00Z
EPSS history
Timeline
  • 23 JAN 16:00Z
    Local privilege escalation from user munge to root
    cvelistv5