Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-13882

CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to check the log and report file permissions was not working as intended and could be bypassed locally. Because of the race, an unprivileged attacker can set up a log and report file, and control that up to the point where the specific routine is doing its check. After that, the file can be removed, recreated, and used for additional attacks.

Published

2020-06-18T18:15:10.967

Last Modified

2024-11-21T05:02:04.157

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 4.2 (MEDIUM)

CVSSv2 Vector

AV:L/AC:H/Au:N/C:P/I:P/A:P

  • Access Vector: LOCAL
  • Access Complexity: HIGH
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

1.9

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-367
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application cisofy lynis < 3.0.0 Yes
Operating System fedoraproject fedora 31 Yes
Operating System fedoraproject fedora 32 Yes
References