CVE-2020-8013CWE-59

permissions: chkstat sets unintended setuid/capabilities for mrsh and wodim

Low · published March 2, 2020

CVSS v3.1
2.2
EPSS
0%
Percentile
23.4
In the wild
Unconfirmed
What it is

A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 set permissions intended for specific binaries on other binaries because it erroneously followed symlinks. The symlinks can't be controlled by attackers on default systems, so exploitation is difficult. This issue affects: SUSE Linux Enterprise Server 12 permissions versions prior to 2015.09.28.1626-17.27.1. SUSE Linux Enterprise Server 15 permissions versions prior to 20181116-9.23.1. SUSE Linux Enterprise Server 11 permissions versions prior to 2013.1.7-0.6.12.1.

The record
Technical detail
CVSS v3.1
2.2 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00317 · 23.4th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2020-03-02T16:35Z
EPSS history
Timeline
  • 02 MAR 16:35Z
    permissions: chkstat sets unintended setuid/capabilities for mrsh and wodim
    cvelistv5