CVE-2019-3698

MEDIUM

nagios < 3.5.1 - Local Privilege Escalation via Symlink Race in Cronjob

Title source: llm

Description

UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11; openSUSE Factory allows local attackers to cause cause DoS or potentially escalate privileges by winning a race. This issue affects: SUSE Linux Enterprise Server 12 nagios version 3.5.1-5.27 and prior versions. SUSE Linux Enterprise Server 11 nagios version 3.0.6-1.25.36.3.1 and prior versions. openSUSE Factory nagios version 4.4.5-2.1 and prior versions.

References (3)

Core 3

Core References

Mailing List, Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00014.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00022.html

Exploit, Issue Tracking, Patch, Vendor Advisory x_refsource_confirm

https://bugzilla.suse.com/show_bug.cgi?id=1156309

Scores

CVSS v3 5.7

EPSS 0.0018

EPSS Percentile 38.6%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L

Details

CWE

CWE-59

Status published

Products (3)

nagios/nagios < 3.5.1

opensuse/backports_sle 15.0 sp1

opensuse/leap 15.1

Published Feb 28, 2020

Tracked Since Feb 18, 2026