CVE-2020-8013: A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise…

PriorityP49low2.5CVSS 3.1

AVLACHPRLUINSUCNILAN

EPSS

0.32%

23.6th percentile

A UNIX Symbolic Link (Symlink) Following vulnerability in chkstat of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15, SUSE Linux Enterprise Server 11 set permissions intended for specific binaries on other binaries because it erroneously followed symlinks. The symlinks can't be controlled by attackers on default systems, so exploitation is difficult. This issue affects: SUSE Linux Enterprise Server 12 permissions versions prior to 2015.09.28.1626-17.27.1. SUSE Linux Enterprise Server 15 permissions versions prior to 20181116-9.23.1. SUSE Linux Enterprise Server 11 permissions versions prior to 2013.1.7-0.6.12.1.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
opensuse	leap	—	—
suse	linux_enterprise_server	—	—
suse	linux_enterprise_server	—	—
suse	linux_enterprise_server	—	—
suse	suse_linux_enterprise_server_11	>= permissions < 2013.1.7-0.6.12.1	2013.1.7-0.6.12.1
suse	suse_linux_enterprise_server_12	>= permissions < 2015.09.28.1626-17.27.1	2015.09.28.1626-17.27.1
suse	suse_linux_enterprise_server_15	>= permissions < 20181116-9.23.1	20181116-9.23.1

CVSS provenance

nvdv3.12.5LOWCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

nvdv2.01.9LOWAV:L/AC:M/Au:N/C:N/I:P/A:N

vendor_oracle7.3CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.