Log in Start free

Vulnerability · Published Oct 16, 2024 · Assigned by suse

CVE-2024-22029tomcat packaging allows for escalation to root from tomcat user

High 7.8

In plain English

A high-severity incorrect permission assignment in Container suse/manager/5.0/x86_64/server:5.0.0-beta1.2.122 from SUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.2%top 92.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root

Affected products (as reported)

VendorProductVersions
SUSE Container suse/manager/5.0/x86_64/server:5.0.0-beta1.2.122 ? – before 9.0.85-150200.57.1
SUSE SUSE Enterprise Storage 7.1 ? – before 9.0.85-150200.57.1
SUSE SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS ? – before 9.0.85-150200.57.1
SUSE SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS ? – before 9.0.85-150200.57.1
SUSE SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS ? – before 9.0.85-150200.57.1
SUSE SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS ? – before 9.0.85-150200.57.1
SUSE SUSE Linux Enterprise High Performance Computing 15 SP5 ? – before 9.0.85-150200.57.1
SUSE SUSE Linux Enterprise Module for Web and Scripting 15 SP5 ? – before 9.0.85-150200.57.1
SUSE SUSE Linux Enterprise Server 15 SP5 ? – before 9.0.85-150200.57.1
SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP5 ? – before 9.0.85-150200.57.1
SUSE SUSE Linux Enterprise High Performance Computing 15 SP6 ? – before 9.0.85-150200.57.1
SUSE SUSE Linux Enterprise Module for Web and Scripting 15 SP6 ? – before 9.0.85-150200.57.1
SUSE SUSE Linux Enterprise Server 15 SP6 ? – before 9.0.85-150200.57.1
SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP6 ? – before 9.0.85-150200.57.1
SUSE SUSE Linux Enterprise Server 15 SP2-LTSS ? – before 9.0.85-150200.57.1
SUSE SUSE Linux Enterprise Server 15 SP3-LTSS ? – before 9.0.85-150200.57.1
SUSE SUSE Linux Enterprise Server 15 SP4-LTSS ? – before 9.0.85-150200.57.1
SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP2 ? – before 9.0.85-150200.57.1
SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP3 ? – before 9.0.85-150200.57.1
SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP4 ? – before 9.0.85-150200.57.1
SUSE SUSE Manager Server 4.3 ? – before 9.0.85-150200.57.1
SUSE openSUSE Leap 15.5 ? – before 9.0.85-150200.57.1
SUSE openSUSE Tumbleweed ? – before 9.0.85-3.1

Weakness: CWE-732 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References