CVE-2018-19638

In supportutils, before version 3.1-5.7.1 and if pacemaker is installed on the system, an unprivileged user could have overwritten arbitrary files in the directory that is used by supportutils to collect the log files.

CVSS v3 4.7 MEDIUM
CVSS v2.0 3.3 LOW

4.7^/10

CVSS v3 : MEDIUM

Vector : AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

3.3^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:M/Au:N/C:N/I:P/A:P

Exploitability : 3.4 / Impact : 4.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00018.html
https://bugzilla.suse.com/show_bug.cgi?id=1118460

Configurations

Configuration 1 (hide)

cpe:2.3:a:opensuse:supportutils:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2019-03-05 16:29

Updated : 2024-02-04 20:03

NVD link : CVE-2018-19638

Mitre link : CVE-2018-19638

CVE.ORG link : CVE-2018-19638

JSON object : View

Products Affected

opensuse

supportutils

CWE

CWE-59

Improper Link Resolution Before File Access ('Link Following')

CWE-377

Insecure Temporary File

{"id": "CVE-2018-19638", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.3, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:N/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.0}, {"type": "Secondary", "source": "security@opentext.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 2.2, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 0.8}]}, "published": "2019-03-05T16:29:00.387", "references": [{"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00018.html", "source": "security@opentext.com"}, {"url": "https://bugzilla.suse.com/show_bug.cgi?id=1118460", "source": "security@opentext.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-59"}]}, {"type": "Secondary", "source": "security@opentext.com", "description": [{"lang": "en", "value": "CWE-377"}]}], "descriptions": [{"lang": "en", "value": "In supportutils, before version 3.1-5.7.1 and if pacemaker is installed on the system, an unprivileged user could have overwritten arbitrary files in the directory that is used by supportutils to collect the log files."}, {"lang": "es", "value": "En Supportutils, en versiones anteriores a la 3.1-5.7.1, y si una bater\u00eda de marcapasos est\u00e1 instalada en el sistema, un usuario sin privilegios podr\u00eda haber sobrescrito archivos arbitrarios en el directorio utilizado por supportutils para recolectar los archivos de log."}], "lastModified": "2023-11-07T02:55:36.383", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:opensuse:supportutils:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "69558DCA-145A-4811-9EE6-B9BADA48F676", "versionEndExcluding": "3.1-5.7.1"}], "operator": "OR"}]}], "sourceIdentifier": "security@opentext.com"}