7.8

CVE-2021-25314

Exploit

hawk: Insecure file permissions

A Creation of Temporary File With Insecure Permissions vulnerability in hawk2 of SUSE Linux Enterprise High Availability 12-SP3, SUSE Linux Enterprise High Availability 12-SP5, SUSE Linux Enterprise High Availability 15-SP2 allows local attackers to escalate to root. This issue affects: SUSE Linux Enterprise High Availability 12-SP3 hawk2 versions prior to 2.6.3+git.1614685906.812c31e9. SUSE Linux Enterprise High Availability 12-SP5 hawk2 versions prior to 2.6.3+git.1614685906.812c31e9. SUSE Linux Enterprise High Availability 15-SP2 hawk2 versions prior to 2.6.3+git.1614684118.af555ad9.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Suse ≫ Hawk2 Version < 2.6.3\+git.1614685906.812c31e9-2.42.1
   Suse ≫ Linux Enterprise High Availability Extension Version 12 Update sp3
Suse ≫ Hawk2 Version < 2.6.3\+git.1614684118.af555ad9
   Suse ≫ Linux Enterprise High Availability Extension Version 15 Update sp2
Suse ≫ Hawk2 Version < 2.6.3\+git.1614685906.812c31e9
   Suse ≫ Linux Enterprise High Availability Extension Version 12 Update sp5
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.38% 0.294
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
SUSE 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-378 Creation of Temporary File With Insecure Permissions

Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.

CWE-668 Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

https://bugzilla.suse.com/show_bug.cgi?id=1182166
Vendor Advisory
Exploit
Issue Tracking