Vulnerability · Published Feb 11, 2021 · Assigned by suse
CVE-2020-8030skuba: Insecure /tmp usage when joining node to cluster
Low 3.6
In plain English
A low-severity security flaw in SUSE CaaS Platform 4.5 from SUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Severity (CVSS 3.1)3.6Low
Exploit odds (30 days)0.3%top 83.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A Insecure Temporary File vulnerability in skuba of SUSE CaaS Platform 4.5 allows local attackers to leak the bootstrapToken or modify the configuration file before it is processed, leading to arbitrary modifications of the machine/cluster.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SUSE | SUSE CaaS Platform 4.5 | suba – before 2.1.7 |
Weakness: CWE-377 · Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
References
- https://bugzilla.suse.com/show_bug.cgi?id=1177361 x_refsource_CONFIRM