CVE-2020-26880 — Improper Privilege Management in Sympa

CWE-269 — Improper Privilege Management7 documents5 sources
Severity
7.8HIGHNVD
EPSS
0.0%
top 87.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
SympaDebian SympaDebian Linux+1 more
Timeline
PublishedOct 7
Latest updateMay 24

Description

Sympa through 6.2.57b.2 allows a local privilege escalation from the sympa user account to full root access by modifying the sympa.conf configuration file (which is owned by sympa) and parsing it through the setuid sympa_newaliases-wrapper executable.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶debiandebian/sympa< sympa 6.2.60~dfsg-2 (bookworm)
▶Debiansympa/sympa< 6.2.60~dfsg-2+3
▶NVDsympa/sympa6.2.56+1

Also affects: Debian Linux 9.0, Fedora 32, 33, 34

🔴Vulnerability Details

2
GHSA
GHSA-jcr2-44h4-65m5: Sympa through 6↗2022-05-24
▶
OSV
CVE-2020-26880: Sympa through 6↗2020-10-07
▶

📋Vendor Advisories

1
Debian
CVE-2020-26880: sympa - Sympa through 6.2.57b.2 allows a local privilege escalation from the sympa user ...↗2020
▶

💬Community

3
Bugzilla
CVE-2020-26880 sympa: local privilege escalation by modifying sympa.conf configuration file [fedora-all]↗2020-10-08
▶
Bugzilla
CVE-2020-26880 sympa: local privilege escalation by modifying sympa.conf configuration file↗2020-10-08
▶
Bugzilla
CVE-2020-26880 sympa: local privilege escalation by modifying sympa.conf configuration file [epel-all]↗2020-10-08
▶
CVE-2020-26880 — Improper Privilege Management in Sympa | cvebase