CVE-2024-22029

CWE-732 — Incorrect Permission Assignment CWE-269 — Improper Privilege Management6 documents6 sources

Severity

7.8HIGH

EPSS

0.0%

top 94.95%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Suse Container Suse/manager/5.0/x86 64/server:5.0.0-beta1.2.122 Suse Opensuse Leap 15.5 Suse Opensuse Tumbleweed +20 more

Timeline

PublishedOct 16

Description

Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages23 packages

▶CVEListV5suse/opensuse_leap_15.5? — 9.0.85-150200.57.1

▶CVEListV5suse/opensuse_tumbleweed? — 9.0.85-3.1

▶CVEListV5suse/suse_manager_server_4.3? — 9.0.85-150200.57.1

▶CVEListV5suse/suse_enterprise_storage_7.1? — 9.0.85-150200.57.1

▶CVEListV5suse/suse_linux_enterprise_server_15_sp5? — 9.0.85-150200.57.1

🔴Vulnerability Details

OSV

CVE-2024-22029: Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root↗2024-10-16

▶

CVEList

tomcat packaging allows for escalation to root from tomcat user↗2024-10-16

▶

GHSA

GHSA-w8vw-x82m-vg68: Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root↗2024-10-16

▶

📋Vendor Advisories

Red Hat

tomcat: Escalation to root from tomcat user via %post script↗2024-02-14

▶

Debian

CVE-2024-22029: tomcat10 - Insecure permissions in the packaging of tomcat allow local users that win a rac...↗2024

▶