CVE-2020-15397 — Incorrect Permission Assignment in + Project Hylafax

CWE-732 — Incorrect Permission AssignmentCWE-269 — Improper Privilege Management8 documents6 sources
Severity
7.8HIGHNVD
EPSS
0.2%
top 54.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Hylafax + Project Hylafax
Timeline
PublishedJun 30
Latest updateMay 24

Description

HylaFAX+ through 7.0.2 and HylaFAX Enterprise have scripts that execute binaries from directories writable by unprivileged users (e.g., locations under /var/spool/hylafax that are writable by the uucp account). This allows these users to execute code in the context of the user calling these binaries (often root).

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages1 packages

Patches

Patch: sourceforge.net ↗Patch: sourceforge.net ↗

🔴Vulnerability Details

3
GHSA
GHSA-2fqh-mw2q-wr69: HylaFAX+ through 7↗2022-05-24
▶
OSV
CVE-2020-15397: HylaFAX+ through 7↗2020-06-30
▶
CVEList
CVE-2020-15397: HylaFAX+ through 7↗2020-06-30
▶

📋Vendor Advisories

1
Debian
CVE-2020-15397: hylafax - HylaFAX+ through 7.0.2 and HylaFAX Enterprise have scripts that execute binaries...↗2020
▶

💬Community

3
Bugzilla
CVE-2020-15397 hylafax+: unsafe handling of user-writable directories could lead to privileged code execution [fedora-all]↗2020-07-01
▶
Bugzilla
CVE-2020-15397 hylafax+: unsafe handling of user-writable directories could lead to privileged code execution↗2020-07-01
▶
Bugzilla
CVE-2020-15397 hylafax+: unsafe handling of user-writable directories could lead to privileged code execution [epel-all]↗2020-07-01
▶
CVE-2020-15397 — Incorrect Permission Assignment | cvebase