« Volver al listado

CVE-2020-8026

Estado: ModificadaAlta (7.8)—

A Incorrect Default Permissions vulnerability in the packaging of inn in openSUSE Leap 15.2, openSUSE Tumbleweed, openSUSE Leap 15.1 allows local attackers with control of the new user to escalate their privileges to root. This issue affects: openSUSE Leap 15.2 inn version 2.6.2-lp152.1.26 and prior versions. openSUSE Tumbleweed inn version 2.6.2-4.2 and prior versions. openSUSE Leap 15.1 inn version 2.5.4-lp151.3.3.1 and prior versions.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Opensuse — Backports SLEOpensuse — LeapOpensuse — Tumbleweed

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-8026",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "meissner@suse.de",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.4,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.5
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "meissner@suse.de",
      "affectedData": [
        {
          "vendor": "openSUSE",
          "product": "openSUSE Leap 15.2",
          "versions": [
            {
              "status": "affected",
              "version": "inn",
              "versionType": "custom",
              "lessThanOrEqual": "2.6.2-lp152.1.26"
            }
          ]
        },
        {
          "vendor": "openSUSE",
          "product": "openSUSE Tumbleweed",
          "versions": [
            {
              "status": "affected",
              "version": "inn",
              "versionType": "custom",
              "lessThanOrEqual": "2.6.2-4.2"
            }
          ]
        },
        {
          "vendor": "openSUSE",
          "product": "openSUSE Leap 15.1",
          "versions": [
            {
              "status": "affected",
              "version": "inn",
              "versionType": "custom",
              "lessThanOrEqual": "2.5.4-lp151.3.3.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-08-07T10:15:11.987",
  "references": [
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00063.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "meissner@suse.de"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00064.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "meissner@suse.de"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00074.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "meissner@suse.de"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00038.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "meissner@suse.de"
    },
    {
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=1172573",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "meissner@suse.de"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00063.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00064.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00074.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00038.html",
      "tags": [
        "Mailing List",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=1172573",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "meissner@suse.de",
      "description": [
        {
          "lang": "en",
          "value": "CWE-276"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Incorrect Default Permissions vulnerability in the packaging of inn in openSUSE Leap 15.2, openSUSE Tumbleweed, openSUSE Leap 15.1 allows local attackers with control of the new user to escalate their privileges to root. This issue affects: openSUSE Leap 15.2 inn version 2.6.2-lp152.1.26 and prior versions. openSUSE Tumbleweed inn version 2.6.2-4.2 and prior versions. openSUSE Leap 15.1 inn version 2.5.4-lp151.3.3.1 and prior versions."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de Permisos Predeterminados Incorrectos en el paquete de inn en openSUSE Leap versión 15.2, openSUSE Tumbleweed, openSUSE Leap versión 15.1, permite a atacantes locales con control del nuevo usuario escalar sus privilegios a root. Este problema afecta a: inn versión 2.6.2-lp152.1.26 y versiones anteriores de openSUSE Leap versión 15.2. inn versión 2.6.2-4.2 y versiones anteriores de openSUSE Tumbleweed. inn versión 2.5.4-lp151.3.3.1 y versiones anteriores de openSUSE Leap versión 15.1"
    }
  ],
  "lastModified": "2026-06-17T03:25:48.873",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40513095-7E6E-46B3-B604-C926F1BA3568"
            },
            {
              "criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "67E82302-4B77-44F3-97B1-24C18AC4A35D"
            },
            {
              "criteria": "cpe:2.3:a:opensuse:tumbleweed:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C6C65B15-A770-421F-A71E-FD6DB540EE1E",
              "versionEndIncluding": "2.6.2-4.2"
            },
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493"
            },
            {
              "criteria": "cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B009C22E-30A4-4288-BCF6-C3E81DEAF45A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "meissner@suse.de"
}