Vulnerability CVE-2019-18901
Published: 2020-03-02

Description:
A UNIX Symbolic Link (Symlink) Following vulnerability in the mysql-systemd-helper of the mariadb packaging of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows local attackers to change the permissions of arbitrary files to 0640. This issue affects: SUSE Linux Enterprise Server 12 mariadb versions prior to 10.2.31-3.25.1. SUSE Linux Enterprise Server 15 mariadb versions prior to 10.2.31-3.26.1.

Type:

CWE-59

 (Improper Link Resolution Before File Access ('Link Following'))

CVSS2 => (AV:L/AC:L/Au:N/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
2.1/10
2.9/10
3.9/10
Exploit range
Attack complexity
Authentication
Local
Low
No required
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None
Affected software
SUSE -> Linux enterprise server 
Opensuse -> LEAP 

 References:
http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00007.html
https://bugzilla.suse.com/show_bug.cgi?id=1160895
Copyright 2024, cxsecurity.com

 

Back to Top