CVE-2020-8018

CWE-276 — Incorrect Default Permissions3 documents3 sources
Severity
7.8HIGH
EPSS
0.0%
top 92.49%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Suse Suse Linux Enterprise Server 15 SP1Suse Linux Enterprise Desktop
Timeline
PublishedMay 4
Latest updateMay 24

Description

A Incorrect Default Permissions vulnerability in the SLES15-SP1-CHOST-BYOS and SLES15-SP1-CAP-Deployment-BYOS images of SUSE Linux Enterprise Server 15 SP1 allows local attackers with the UID 1000 to escalate to root due to a /etc directory owned by the user This issue affects: SUSE Linux Enterprise Server 15 SP1 SLES15-SP1-CAP-Deployment-BYOS version 1.0.1 and prior versions; SLES15-SP1-CHOST-BYOS versions prior to 1.0.3 and prior versions;

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.5 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5suse/suse_linux_enterprise_server_15_sp1SLES15-SP1-CAP-Deployment-BYOS — 1.0.1+1

🔴Vulnerability Details

2
GHSA
GHSA-4gcx-h2fv-f6c9: A Incorrect Default Permissions vulnerability in the SLES15-SP1-CHOST-BYOS and SLES15-SP1-CAP-Deployment-BYOS images of SUSE Linux Enterprise Server 1↗2022-05-24
▶
CVEList
User owned /etc in SLES15-SP1-CHOST-BYOS↗2020-05-04
▶