Vulnerability Details CVE-2019-3698
UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11; openSUSE Factory allows local attackers to cause cause DoS or potentially escalate privileges by winning a race. This issue affects: SUSE Linux Enterprise Server 12 nagios version 3.5.1-5.27 and prior versions. SUSE Linux Enterprise Server 11 nagios version 3.0.6-1.25.36.3.1 and prior versions. openSUSE Factory nagios version 4.4.5-2.1 and prior versions.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 61.4%
CVSS Severity
CVSS v3 Score 5.7
CVSS v2 Score 6.9
References
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00014.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00022.html
- https://bugzilla.suse.com/show_bug.cgi?id=1156309
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00014.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00022.html
- https://bugzilla.suse.com/show_bug.cgi?id=1156309
Products affected by CVE-2019-3698
-
cpe:2.3:a:nagios:nagios:2.0.1
-
cpe:2.3:a:nagios:nagios:2.1.3
-
cpe:2.3:a:nagios:nagios:3.0
-
cpe:2.3:a:nagios:nagios:3.0.1
-
cpe:2.3:a:nagios:nagios:3.0.2
-
cpe:2.3:a:nagios:nagios:3.0.3
-
cpe:2.3:a:nagios:nagios:3.0.4
-
cpe:2.3:a:nagios:nagios:3.0.5
-
cpe:2.3:a:nagios:nagios:3.0.6
-
cpe:2.3:a:nagios:nagios:3.1.0
-
cpe:2.3:a:nagios:nagios:3.1.1
-
cpe:2.3:a:nagios:nagios:3.1.2
-
cpe:2.3:a:nagios:nagios:3.2.0
-
cpe:2.3:a:nagios:nagios:3.2.1
-
cpe:2.3:a:nagios:nagios:3.2.2
-
cpe:2.3:a:nagios:nagios:3.2.3
-
cpe:2.3:a:nagios:nagios:3.3.1
-
cpe:2.3:a:nagios:nagios:3.4.0
-
cpe:2.3:a:nagios:nagios:3.4.1
-
cpe:2.3:a:nagios:nagios:3.4.2
-
cpe:2.3:a:nagios:nagios:3.4.3
-
cpe:2.3:a:nagios:nagios:3.4.4
-
cpe:2.3:a:opensuse:backports_sle:15.0
-
cpe:2.3:o:opensuse:leap:15.1
-
cpe:2.3:o:suse:linux_enterprise_server:11
-
cpe:2.3:o:suse:linux_enterprise_server:12