7.8

CVE-2021-25314

Exploit

A Creation of Temporary File With Insecure Permissions vulnerability in hawk2 of SUSE Linux Enterprise High Availability 12-SP3, SUSE Linux Enterprise High Availability 12-SP5, SUSE Linux Enterprise High Availability 15-SP2 allows local attackers to escalate to root. This issue affects: SUSE Linux Enterprise High Availability 12-SP3 hawk2 versions prior to 2.6.3+git.1614685906.812c31e9. SUSE Linux Enterprise High Availability 12-SP5 hawk2 versions prior to 2.6.3+git.1614685906.812c31e9. SUSE Linux Enterprise High Availability 15-SP2 hawk2 versions prior to 2.6.3+git.1614684118.af555ad9.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Suse ≫ Hawk2 Version < 2.6.3\+git.1614685906.812c31e9-2.42.1
   Suse ≫ Linux Enterprise High Availability Extension Version12 Updatesp3
Suse ≫ Hawk2 Version < 2.6.3\+git.1614684118.af555ad9
   Suse ≫ Linux Enterprise High Availability Extension Version15 Updatesp2
Suse ≫ Hawk2 Version < 2.6.3\+git.1614685906.812c31e9
   Suse ≫ Linux Enterprise High Availability Extension Version12 Updatesp5
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.1% 0.249
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
meissner@suse.de 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-378 Creation of Temporary File With Insecure Permissions

Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.

CWE-668 Exposure of Resource to Wrong Sphere

The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

https://bugzilla.suse.com/show_bug.cgi?id=1182166
Vendor Advisory
Exploit
Issue Tracking