CVE-2020-13882

 

Published at: - 18-06-2020 08:15

Last modified: - 10-07-2022 11:15

Total changes: - 2

Description

CISOfy Lynis before 3.0.0 has Incorrect Access Control because of a TOCTOU race condition. The routine to check the log and report file permissions was not working as intended and could be bypassed locally. Because of the race, an unprivileged attacker can set up a log and report file, and control that up to the point where the specific routine is doing its check. After that, the file can be removed, recreated, and used for additional attacks.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

 

Verification logic

 

Reference

• https://cisofy.com/security/cve/cve-2020-13882/
• FEDORA-2020-f251753b0f-
• FEDORA-2020-059e1591d6-
• https://cwe.mitre.org/data/definitions/367.html

 

Keywords

NVD

 

CVE-2020-13882

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures