Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-8022

A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8 allows local attackers to escalate from group tomcat to root. This issue affects: SUSE Enterprise Storage 5 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP4 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 12-SP5 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 15-LTSS tomcat versions prior to 9.0.35-3.57.3. SUSE Linux Enterprise Server for SAP 12-SP2 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 12-SP3 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 15 tomcat versions prior to 9.0.35-3.57.3. SUSE OpenStack Cloud 7 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud 8 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud Crowbar 8 tomcat versions prior to 8.0.53-29.32.1.

Published

2020-06-29T09:15:11.307

Last Modified

2024-11-21T05:38:14.210

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.7 (HIGH)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

  • Access Vector: LOCAL
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

3.9

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-276
  • Type: Secondary
    CWE-276
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application apache tomcat < 8.0.53-29.32.1 Yes
Application suse enterprise_storage 5.0 No
Application apache tomcat < 8.0.53-29.32.1 Yes
Operating System suse linux_enterprise_server 12 No
Application apache tomcat < 8.0.53-29.32.1 Yes
Operating System suse linux_enterprise_server 12 No
Application apache tomcat < 8.0.53-29.32.1 Yes
Operating System suse linux_enterprise_server 12 No
Application apache tomcat < 8.0.53-29.32.1 Yes
Operating System suse linux_enterprise_server 12 No
Application apache tomcat < 8.0.53-29.32.1 Yes
Operating System suse linux_enterprise_server 12 No
Application apache tomcat < 8.0.53-29.32.1 Yes
Operating System suse linux_enterprise_server 12 No
Application apache tomcat < 8.0.53-29.32.1 Yes
Application suse openstack_cloud 7.0 No
Application apache tomcat < 8.0.53-29.32.1 Yes
Application suse openstack_cloud 8.0 No
Application apache tomcat < 8.0.53-29.32.1 Yes
Application suse openstack_cloud_crowbar 8.0 No
Application apache tomcat < 9.0.35-3.39.1 Yes
Operating System suse linux_enterprise_server 12 No
Application apache tomcat < 9.0.35-3.39.1 Yes
Operating System suse linux_enterprise_server 12 No
Application apache tomcat < 9.0.35-3.57.3 Yes
Operating System suse linux_enterprise_server 15 No
Operating System opensuse leap 15.1 Yes
References