CVE-2019-3693CWE-59

Local privilege escalation from user wwwrun to root in the packaging of mailman

High · published January 24, 2020

CVSS v3.1
7.7
EPSS
0%
Percentile
29.2
In the wild
Unconfirmed
What it is

A symlink following vulnerability in the packaging of mailman in SUSE Linux Enterprise Server 11, SUSE Linux Enterprise Server 12; openSUSE Leap 15.1 allowed local attackers to escalate their privileges from user wwwrun to root. Additionally arbitrary files could be changed to group mailman. This issue affects: SUSE Linux Enterprise Server 11 mailman versions prior to 2.1.15-9.6.15.1. SUSE Linux Enterprise Server 12 mailman versions prior to 2.1.17-3.11.1. openSUSE Leap 15.1 mailman version 2.1.29-lp151.2.14 and prior versions.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00365 · 29.2th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2020-01-24T10:05Z
EPSS history
Timeline
  • 24 JAN 10:05Z
    Local privilege escalation from user wwwrun to root in the packaging of mailman
    cvelistv5