CVE-2018-19640 — Insecure Temporary File in Supportutils

CWE-377 — Insecure Temporary FileCWE-20 — Improper Input Validation3 documents3 sources
Severity
5.5MEDIUMNVD
CNA2.2
EPSS
0.1%
top 83.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Suse SupportutilsOpensuse Supportutils
Timeline
PublishedMar 5
Latest updateMay 14

Description

If the attacker manages to create files in the directory used to collect log files in supportutils before version 3.1-5.7.1 (e.g. with CVE-2018-19638) he can kill arbitrary processes on the local machine.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5suse/supportutilsunspecified — 3.1-5.7.1
▶NVDopensuse/supportutils< 3.1-5.7.1

🔴Vulnerability Details

2
GHSA
GHSA-7g5j-9rpf-g2r7: If the attacker manages to create files in the directory used to collect log files in supportutils before version 3↗2022-05-14
▶
CVEList
Code execution if run with command line switch -v↗2019-03-05
▶
CVE-2018-19640 — Insecure Temporary File | cvebase