9.8

CVE-2019-3681

Exploit

A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software Development Kit 12-SP5, SUSE Linux Enterprise Software Development Kit 12-SP4; openSUSE Leap 15.1, openSUSE Factory allowed remote attackers that can change downloaded packages to overwrite arbitrary files. This issue affects: SUSE Linux Enterprise Module for Development Tools 15 osc versions prior to 0.169.1-3.20.1. SUSE Linux Enterprise Software Development Kit 12-SP5 osc versions prior to 0.162.1-15.9.1. SUSE Linux Enterprise Software Development Kit 12-SP4 osc versions prior to 0.162.1-15.9.1. openSUSE Leap 15.1 osc versions prior to 0.169.1-lp151.2.15.1. openSUSE Factory osc versions prior to 0.169.0 .

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Opensuse ≫ Osc Version < 0.169.1-3.20.1
   Suse ≫ Linux Enterprise Server Version15
Opensuse ≫ Osc Version < 0.162.1-15.9.1
   Suse ≫ Linux Enterprise Software Development Kit Version12 Updatesp5
Opensuse ≫ Osc Version < 0.162.1-15.9.1
   Suse ≫ Linux Enterprise Software Development Kit Version12 Updatesp4
Opensuse ≫ Osc Version < 0.169.1-lp151.2.15.1
   Opensuse ≫ Leap Version15.1
Opensuse ≫ Osc Version < 0.169.0
   Opensuse ≫ Factory Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.62% 0.812
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 6.4 10 4.9
AV:N/AC:L/Au:N/C:N/I:P/A:P
meissner@suse.de 7.5 1.6 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-73 External Control of File Name or Path

The product allows user input to control or influence paths or file names that are used in filesystem operations.

https://bugzilla.suse.com/show_bug.cgi?id=1122675
Vendor Advisory
Exploit
Issue Tracking