Detections
Analytics

CVE-2020-28407

high

Description

In swtpm before 0.4.2 and 0.5.x before 0.5.1, a local attacker may be able to overwrite arbitrary files via a symlink attack against a temporary file such as TMP2-00.permall.

References

https://github.com/stefanberger/swtpm/releases/tag/v0.5.1

https://github.com/stefanberger/swtpm/releases/tag/v0.4.2

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-20866

https://bugzilla.suse.com/show_bug.cgi?id=1198395

Details

Source: Mitre, NVD

Published: 2023-11-03

Updated: 2023-11-09

Risk Information

CVSS v2

Base Score: 6.2

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:C/A:C

Severity: Medium

CVSS v3

Base Score: 7.1

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Severity: High

EPSS

EPSS: 0.00279