High severity · published Aug 7, 2020
CVE-2020-8026
A Incorrect Default Permissions vulnerability in the packaging of inn in openSUSE Leap 15.2, openSUSE Tumbleweed, openSUSE Leap 15.1 allows local attackers with control of the new…
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
A Incorrect Default Permissions vulnerability in the packaging of inn in openSUSE Leap 15.2, openSUSE Tumbleweed, openSUSE Leap 15.1 allows local attackers with control of the new user to escalate their privileges to root. This issue affects: openSUSE Leap 15.2 inn version 2.6.2-lp152.1.26 and prior versions. openSUSE Tumbleweed inn version 2.6.2-4.2 and prior versions. openSUSE Leap 15.1 inn version 2.5.4-lp151.3.3.1 and prior versions.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BS
Backports Sle · Opensuse
15.0; 15.0 · source: NVD
LE
Leap · Opensuse
15.1; 15.2 · source: NVD
TU
Tumbleweed · Opensuse
through 2.6.2-4.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-8026
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-8026
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00063.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00064.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00074.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00038.html
Issue Tracking
https://bugzilla.suse.com/show_bug.cgi?id=1172573
More from Backports Sle
9.8
CVE-2020-12641
Roundcube Webmail Remote Code Execution Vulnerability
9.6
CVE-2020-15999
Google Chrome FreeType Heap Buffer Overflow Vulnerability
8.8
CVE-2020-16009
Google Chromium V8 Type Confusion Vulnerability
9.8
CVE-2020-26935
An issue was discovered in SearchController in phpMyAdmin before 4.9.6 and 5.x before 5.0.3
9.8
CVE-2020-11800
Zabbix Server 2.2.x and 3.0.x before 3.0.31, and 3.2 allows remote attackers to execute arbitrary code