CVE-2020-8025

MEDIUM

SUSE Linux Enterprise Server <20170707-3.24.1 - Info Disclosure

Title source: llm
STIX 2.1

Description

A Incorrect Execution-Assigned Permissions vulnerability in the permissions package of SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Tumbleweed sets the permissions for some of the directories of the pcp package to unintended settings. This issue affects: SUSE Linux Enterprise Server 12-SP4 permissions versions prior to 20170707-3.24.1. SUSE Linux Enterprise Server 15-LTSS permissions versions prior to 20180125-3.27.1. SUSE Linux Enterprise Server for SAP 15 permissions versions prior to 20180125-3.27.1. openSUSE Leap 15.1 permissions versions prior to 20181116-lp151.4.24.1. openSUSE Tumbleweed permissions versions prior to 20200624.

References (1)

Core 1
Core References
Exploit, Issue Tracking, Vendor Advisory x_refsource_confirm
https://bugzilla.suse.com/show_bug.cgi?id=1171883

Scores

CVSS v3 6.1
EPSS 0.0005
EPSS Percentile 15.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Details

CWE
CWE-279
Status published
Products (3)
suse/linux_enterprise_high_performance_computing 15 (2 CPE variants)
suse/linux_enterprise_server 15 (3 CPE variants)
suse/linux_enterprise_software_development_kit 12 sp4 (2 CPE variants)
Published Aug 07, 2020
Tracked Since Feb 18, 2026