Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

mysql-systemd-helper allows setting 640 permissions of arbitrary files (SUSE SUSE Linux Enterprise Server 12)

CVE-2019-18901
MEDIUM 5.1

En bref

Source
NVD
EPSS
EPSS 0.38 % · centile 32 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
suse
Statut NVD
Modified

Rechercher sur…

Description

A UNIX Symbolic Link (Symlink) Following vulnerability in the mysql-systemd-helper of the mariadb packaging of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows local attackers to change the permissions of arbitrary files to 0640. This issue affects: SUSE Linux Enterprise Server 12 mariadb versions prior to 10.2.31-3.25.1. SUSE Linux Enterprise Server 15 mariadb versions prior to 10.2.31-3.26.1.

Faiblesses (CWE)

  • CWE-59 — Suivi de lien non maîtrisé

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1MEDIUM 5.1CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:Lsuse
CVSS 3.1MEDIUM 5.1CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:LNVD · meissner@suse.de (Secondary)
CVSS 3.1MEDIUM 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NNVD · nvd@nist.gov (Primary)
CVSS 2.0LOW 2.1AV:L/AC:L/Au:N/C:N/I:P/A:NNVD · nvd@nist.gov (Primary)

Références européennes

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
SUSE · SUSE Linux Enterprise Server 12affected mariadb < 10.2.31-3.25.1
SUSE · SUSE Linux Enterprise Server 15affected mariadb < 10.2.31-3.26.1

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD