CVE-2017-18225

EPSS 0.04%
Published 12.03.2018 04:29:00
Last modified 21.11.2024 03:19:36
Source cve@mitre.org
Teams watchlist Login
Open Login

The Gentoo net-im/jabberd2 package through 2.6.1 installs jabberd, jabberd2-c2s, jabberd2-router, jabberd2-s2s, and jabberd2-sm in /usr/bin owned by the jabber account, which might allow local users to gain privileges by leveraging access to this account and then waiting for root to execute one of these programs.

Affected products Warnungen 0 Metrics 3 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Jabberd2 ≫ Jabberd2 Version <= 2.6.1

Gentoo ≫ Linux Version-

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.04%	0.067

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.8	1.8	5.9	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	4.6	3.9	6.4	AV:L/AC:L/Au:N/C:P/I:P/A:P

CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

https://bugs.gentoo.org/629412

Third Party Advisory

Issue Tracking

https://nvd.nist.gov/vuln/detail/CVE-2017-18225

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2017-18225

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2017-18225

EUVD