CVE-2023-3972
Severity
7.8HIGH
EPSS
0.0%
top 99.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedNov 1
Description
A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege escalation. Before the insights-client has been registered on the system by root, an unprivileged local user or attacker could create the /var/tmp/insights-client directory (owning the directory with read, write, and execute permissions) on the system. After the insights-client is registered by root, an att…
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9
Affected Packages4 packages
Also affects: Enterprise Linux 7.0, 8.0, 9.0, 8.6, 8.8, 9.2, 8.2, 8.4, 8.1