CVE-2020-24331

high

Description

An issue was discovered in TrouSerS through 0.3.14. If the tcsd daemon is started with root privileges, the tss user still has read and write access to the /etc/tcsd.conf file (which contains various settings related to this daemon).

References

https://bugzilla.suse.com/show_bug.cgi?id=1164472

https://sourceforge.net/p/trousers/mailman/message/37015817/

https://seclists.org/oss-sec/2020/q2/att-135/tcsd_fixes.patch

http://www.openwall.com/lists/oss-security/2020/08/14/1

https://lists.fedoraproject.org/archives/list/[email protected]/message/SSDL7COIFCZQMUBNAASNMKMX7W5JUHRD/

Details

Source: MITRE

Published: 2020-08-13

Updated: 2022-04-28

Type: CWE-269

Risk Information

CVSS v2

Base Score: 7.2

Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C

Impact Score: 10

Exploitability Score: 3.9

Severity: HIGH

CVSS v3

Base Score: 7.8

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Impact Score: 5.9

Exploitability Score: 1.8

Severity: HIGH