CVE-2020-8025

{"containers": {"cna": {"affected": [{"product": "SUSE Linux Enterprise Server 12-SP4", "vendor": "SUSE", "versions": [{"lessThan": "20170707-3.24.1", "status": "affected", "version": "permissions", "versionType": "custom"}]}, {"product": "SUSE Linux Enterprise Server 15-LTSS", "vendor": "SUSE", "versions": [{"lessThan": "20180125-3.27.1", "status": "affected", "version": "permissions", "versionType": "custom"}]}, {"product": "SUSE Linux Enterprise Server for SAP 15", "vendor": "SUSE", "versions": [{"lessThan": "20180125-3.27.1", "status": "affected", "version": "permissions", "versionType": "custom"}]}, {"product": "openSUSE Leap 15.1", "vendor": "openSUSE", "versions": [{"lessThan": "20181116-lp151.4.24.1", "status": "affected", "version": "permissions", "versionType": "custom"}]}, {"product": "openSUSE Tumbleweed", "vendor": "openSUSE", "versions": [{"lessThan": "20200624", "status": "affected", "version": "permissions", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Matthias Gerstner of SUSE"}], "datePublic": "2020-07-06T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "A Incorrect Execution-Assigned Permissions vulnerability in the permissions package of SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Tumbleweed sets the permissions for some of the directories of the pcp package to unintended settings. This issue affects: SUSE Linux Enterprise Server 12-SP4 permissions versions prior to 20170707-3.24.1. SUSE Linux Enterprise Server 15-LTSS permissions versions prior to 20180125-3.27.1. SUSE Linux Enterprise Server for SAP 15 permissions versions prior to 20180125-3.27.1. openSUSE Leap 15.1 permissions versions prior to 20181116-lp151.4.24.1. openSUSE Tumbleweed permissions versions prior to 20200624."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-279", "description": "CWE-279: Incorrect Execution-Assigned Permissions", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-08-07T10:10:14.000Z", "orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1171883"}], "source": {"advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1171883", "defect": ["1171883"], "discovery": "INTERNAL"}, "title": "outdated entries in permissions profiles for /var/lib/pcp/tmp/* may cause security issues", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@suse.com", "DATE_PUBLIC": "2020-07-06T00:00:00.000Z", "ID": "CVE-2020-8025", "STATE": "PUBLIC", "TITLE": "outdated entries in permissions profiles for /var/lib/pcp/tmp/* may cause security issues"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "SUSE Linux Enterprise Server 12-SP4", "version": {"version_data": [{"version_affected": "<", "version_name": "permissions", "version_value": "20170707-3.24.1"}]}}, {"product_name": "SUSE Linux Enterprise Server 15-LTSS", "version": {"version_data": [{"version_affected": "<", "version_name": "permissions", "version_value": "20180125-3.27.1"}]}}, {"product_name": "SUSE Linux Enterprise Server for SAP 15", "version": {"version_data": [{"version_affected": "<", "version_name": "permissions", "version_value": "20180125-3.27.1"}]}}]}, "vendor_name": "SUSE"}, {"product": {"product_data": [{"product_name": "openSUSE Leap 15.1", "version": {"version_data": [{"version_affected": "<", "version_name": "permissions", "version_value": "20181116-lp151.4.24.1"}]}}, {"product_name": "openSUSE Tumbleweed", "version": {"version_data": [{"version_affected": "<", "version_name": "permissions", "version_value": "20200624"}]}}]}, "vendor_name": "openSUSE"}]}}, "credit": [{"lang": "eng", "value": "Matthias Gerstner of SUSE"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A Incorrect Execution-Assigned Permissions vulnerability in the permissions package of SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Tumbleweed sets the permissions for some of the directories of the pcp package to unintended settings. This issue affects: SUSE Linux Enterprise Server 12-SP4 permissions versions prior to 20170707-3.24.1. SUSE Linux Enterprise Server 15-LTSS permissions versions prior to 20180125-3.27.1. SUSE Linux Enterprise Server for SAP 15 permissions versions prior to 20180125-3.27.1. openSUSE Leap 15.1 permissions versions prior to 20181116-lp151.4.24.1. openSUSE Tumbleweed permissions versions prior to 20200624."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-279: Incorrect Execution-Assigned Permissions"}]}]}, "references": {"reference_data": [{"name": "https://bugzilla.suse.com/show_bug.cgi?id=1171883", "refsource": "CONFIRM", "url": "https://bugzilla.suse.com/show_bug.cgi?id=1171883"}]}, "source": {"advisory": "https://bugzilla.suse.com/show_bug.cgi?id=1171883", "defect": ["1171883"], "discovery": "INTERNAL"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T09:48:25.473Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1171883"}]}]}, "cveMetadata": {"assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "assignerShortName": "suse", "cveId": "CVE-2020-8025", "datePublished": "2020-08-07T10:10:14.243Z", "dateReserved": "2020-01-27T00:00:00.000Z", "dateUpdated": "2024-09-16T19:09:19.442Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "SUSE Linux Enterprise Server 12-SP4", "vendor": "SUSE", "versions": [{"lessThan": "20170707-3.24.1", "status": "affected", "version": "permissions", "versionType": "custom"}]}, {"product": "SUSE Linux Enterprise Server 15-LTSS", "vendor": "SUSE", "versions": [{"lessThan": "20180125-3.27.1", "status": "affected", "version": "permissions", "versionType": "custom"}]}, {"product": "SUSE Linux Enterprise Server for SAP 15", "vendor": "SUSE", "versions": [{"lessThan": "20180125-3.27.1", "status": "affected", "version": "permissions", "versionType": "custom"}]}, {"product": "openSUSE Leap 15.1", "vendor": "openSUSE", "versions": [{"lessThan": "20181116-lp151.4.24.1", "status": "affected", "version": "permissions", "versionType": "custom"}]}, {"product": "openSUSE Tumbleweed", "vendor": "openSUSE", "versions": [{"lessThan": "20200624", "status": "affected", "version": "permissions", "versionType": "custom"}]}], "source": "meissner@suse.de"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15:*:*:*:espos:*:*:*", "matchCriteriaId": "EBD80A62-9F12-44C1-B41B-EC4D7F58C29B", "vulnerable": true}, {"criteria": "cpe:2.3:o:suse:linux_enterprise_high_performance_computing:15:*:*:*:ltss:*:*:*", "matchCriteriaId": "C7133558-C5CC-499C-801B-2E8AEC1D71B8", "vulnerable": true}, {"criteria": "cpe:2.3:o:suse:linux_enterprise_server:15:*:*:*:ltss:*:*:*", "matchCriteriaId": "6027470B-9B9F-4AB3-8A0D-41506F7E9183", "vulnerable": true}, {"criteria": "cpe:2.3:o:suse:linux_enterprise_server:15:sp1:*:*:*:*:*:*", "matchCriteriaId": "8A2C602E-AA0C-44DF-BC22-E32CADF1F05B", "vulnerable": true}, {"criteria": "cpe:2.3:o:suse:linux_enterprise_server:15:sp2:*:*:*:*:*:*", "matchCriteriaId": "5372BB07-73C9-4DB3-95C4-108C1A06683C", "vulnerable": true}, {"criteria": "cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp4:*:*:*:*:*:*", "matchCriteriaId": "227AB4E0-7CD4-4094-BAA4-E98DC5279C97", "vulnerable": true}, {"criteria": "cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp5:*:*:*:*:*:*", "matchCriteriaId": "6C734CEC-64F2-4129-B52E-C81884B3AC9A", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A Incorrect Execution-Assigned Permissions vulnerability in the permissions package of SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Tumbleweed sets the permissions for some of the directories of the pcp package to unintended settings. This issue affects: SUSE Linux Enterprise Server 12-SP4 permissions versions prior to 20170707-3.24.1. SUSE Linux Enterprise Server 15-LTSS permissions versions prior to 20180125-3.27.1. SUSE Linux Enterprise Server for SAP 15 permissions versions prior to 20180125-3.27.1. openSUSE Leap 15.1 permissions versions prior to 20181116-lp151.4.24.1. openSUSE Tumbleweed permissions versions prior to 20200624."}, {"lang": "es", "value": "Una vulnerabilidad de Permisos de Ejecuci\u00f3n Asignados Incorrectos en el paquete permissions de SUSE Linux Enterprise Server versi\u00f3n 12-SP4, SUSE Linux Enterprise Server versi\u00f3n 15-LTSS, SUSE Linux Enterprise Server para SAP 15; openSUSE Leap versi\u00f3n 15.1, openSUSE Tumbleweed, establece los permisos para algunos de los directorios del paquete pcp en configuraciones no deseadas. Este problema afecta: permissions versiones anteriores a 20170707-3.24.1 de SUSE Linux Enterprise Server 12-SP4. permissions versiones anteriores a 20180125-3.27.1 de SUSE Linux Enterprise Server versi\u00f3n 15-LTSS. permissions versiones anteriores a 20180125-3.27.1 de SUSE Linux Enterprise Server para SAP 15. permissions versiones anteriores a 20181116-lp151.4.24.1 de openSUSE Leap versi\u00f3n 15.1. permissions versiones anteriores a 20200624 de openSUSE Tumbleweed"}], "id": "CVE-2020-8025", "lastModified": "2026-06-17T03:25:48.747", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.7, "source": "meissner@suse.de", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.5, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-08-07T10:15:11.750", "references": [{"source": "meissner@suse.de", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1171883"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.suse.com/show_bug.cgi?id=1171883"}], "sourceIdentifier": "meissner@suse.de", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-279"}], "source": "meissner@suse.de", "type": "Secondary"}]}

{"bugzilla": {"description": "pcp: Insecure permission of /var/lib/pcp/tmp/ directories on SUSE", "id": "1919933", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1919933"}, "csaw": false, "cvss3": {"cvss3_base_score": "9.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-276", "details": ["A Incorrect Execution-Assigned Permissions vulnerability in the permissions package of SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Tumbleweed sets the permissions for some of the directories of the pcp package to unintended settings. This issue affects: SUSE Linux Enterprise Server 12-SP4 permissions versions prior to 20170707-3.24.1. SUSE Linux Enterprise Server 15-LTSS permissions versions prior to 20180125-3.27.1. SUSE Linux Enterprise Server for SAP 15 permissions versions prior to 20180125-3.27.1. openSUSE Leap 15.1 permissions versions prior to 20181116-lp151.4.24.1. openSUSE Tumbleweed permissions versions prior to 20200624."], "name": "CVE-2020-8025", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "pcp", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "pcp", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "pcp", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "pcp", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2021-01-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2020-8025\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-8025"], "threat_severity": "Moderate"}

{}