Vulnerability · Published Jun 10, 2021 · Assigned by suse
CVE-2021-25322python-HyperKitty: hyperkitty-permissions.sh used during %post allows local privilege escalation from hyperkitty user to root
Medium 6.8
In plain English
A medium-severity security flaw in Factory from openSUSE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).
Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)0.4%top 61.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A UNIX Symbolic Link (Symlink) Following vulnerability in python-HyperKitty of openSUSE Leap 15.2, Factory allows local attackers to escalate privileges from the user hyperkitty or hyperkitty-admin to root. This issue affects: openSUSE Leap 15.2 python-HyperKitty version 1.3.2-lp152.2.3.1 and prior versions. openSUSE Factory python-HyperKitty versions prior to 1.3.4-5.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu:22.04:LTS | hyperkitty | no fix listed | UBUNTU-CVE-2021-25322 |
| Ubuntu:24.04:LTS | hyperkitty | no fix listed | UBUNTU-CVE-2021-25322 |
| Ubuntu:25.10 | hyperkitty | no fix listed | UBUNTU-CVE-2021-25322 |
| Ubuntu:26.04:LTS | hyperkitty | no fix listed | UBUNTU-CVE-2021-25322 |
| Ubuntu:26.10 | hyperkitty | no fix listed | UBUNTU-CVE-2021-25322 |
Affected products (as reported)
Weakness: CWE-61 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
References
- https://bugzilla.suse.com/show_bug.cgi?id=1182373 x_refsource_CONFIRM