CVE-2019-18901

MEDIUM

SUSE Linux Enterprise Server <10.2.31-3.25.1 - Privilege Escalation

Title source: llm

Description

A UNIX Symbolic Link (Symlink) Following vulnerability in the mysql-systemd-helper of the mariadb packaging of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows local attackers to change the permissions of arbitrary files to 0640. This issue affects: SUSE Linux Enterprise Server 12 mariadb versions prior to 10.2.31-3.25.1. SUSE Linux Enterprise Server 15 mariadb versions prior to 10.2.31-3.26.1.

References (2)

Core 2

Core References

Broken Link, Mailing List, Vendor Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2020-03/msg00007.html

Issue Tracking, Vendor Advisory x_refsource_confirm

https://bugzilla.suse.com/show_bug.cgi?id=1160895

Scores

CVSS v3 5.1

EPSS 0.0010

EPSS Percentile 27.4%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Details

CWE

CWE-59

Status published

Products (3)

opensuse/leap 15.1

suse/linux_enterprise_server 12

suse/linux_enterprise_server 15

Published Mar 02, 2020

Tracked Since Feb 18, 2026