Local privilege escalation from user salt to root

CVE-2019-18897

8.4HIGH

Key Information

Vendor: Suse
Status: Suse Linux Enterprise Server 12; Suse Linux Enterprise Server 15; Factory
Vendor: CVE Published:; 2 March 2020

Summary

A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of salt of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15; openSUSE Factory allows local attackers to escalate privileges from user salt to root. This issue affects: SUSE Linux Enterprise Server 12 salt-master version 2019.2.0-46.83.1 and prior versions. SUSE Linux Enterprise Server 15 salt-master version 2019.2.0-6.21.1 and prior versions. openSUSE Factory salt-master version 2019.2.2-3.1 and prior versions.

Affected Version(s)

SUSE Linux Enterprise Server 12 <= 2019.2.0-46.83.1

SUSE Linux Enterprise Server 15 <= 2019.2.0-6.21.1

Factory <= 2019.2.2-3.1

CVSS V3.1

Score:

8.4

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Local

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Risk change from: 7.8 to: 8.4 - (HIGH)
Feb 22, 2024
Vulnerability published.
Mar 2, 2020
Vulnerability Reserved.
Nov 12, 2019

Collectors

NVD DatabaseMitre Database

Credit

Johannes Segitz