Log in Start free

Vulnerability · Published Aug 7, 2020 · Assigned by suse

CVE-2020-8025outdated entries in permissions profiles for /var/lib/pcp/tmp/* may cause security issues

Medium 6.1

In plain English

A medium-severity security flaw in openSUSE Leap 15.1 from openSUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.5%top 58.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A Incorrect Execution-Assigned Permissions vulnerability in the permissions package of SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Tumbleweed sets the permissions for some of the directories of the pcp package to unintended settings. This issue affects: SUSE Linux Enterprise Server 12-SP4 permissions versions prior to 20170707-3.24.1. SUSE Linux Enterprise Server 15-LTSS permissions versions prior to 20180125-3.27.1. SUSE Linux Enterprise Server for SAP 15 permissions versions prior to 20180125-3.27.1. openSUSE Leap 15.1 permissions versions prior to 20181116-lp151.4.24.1. openSUSE Tumbleweed permissions versions prior to 20200624.

Affected products (as reported)

VendorProductVersions
SUSE SUSE Linux Enterprise Server 12-SP4 permissions – before 20170707-3.24.1
SUSE SUSE Linux Enterprise Server 15-LTSS permissions – before 20180125-3.27.1
SUSE SUSE Linux Enterprise Server for SAP 15 permissions – before 20180125-3.27.1
openSUSE openSUSE Leap 15.1 permissions – before 20181116-lp151.4.24.1
openSUSE openSUSE Tumbleweed permissions – before 20200624

Weakness: CWE-279 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

References