Vulnerability in SUSE Manager Server
CVE-2020-8028
A Improper Access Control vulnerability in the configuration of salt of SUSE Linux Enterprise Module for SUSE Manager Server 4.1, SUSE Manager Proxy 4.0, SUSE Manager Retail Branch Server 4.0, SUSE Manager Server 3.2, SUSE Manager Server 4.0 allows local users to escalate to root on every system managed by SUSE manager. On the managing node itself code can be executed as user salt, potentially allowing for escalation to root there. This issue affects: SUSE Linux Enterprise Module for SUSE Manager Server 4.1 google-gson versions prior to 2.8.5-3.4.3, httpcomponents-client-4.5.6-3.4.2, httpcomponents-. SUSE Manager Proxy 4.0 release-notes-susemanager-proxy versions prior to 4.0.9-0.16.38.1. SUSE Manager Retail Branch Server 4.0 release-notes-susemanager-proxy versions prior to 4.0.9-0.16.38.1. SUSE Manager Server 3.2 salt-netapi-client versions prior to 0.16.0-4.14.1, spacewalk-. SUSE Manager Server 4.0 release-notes-susemanager versions prior to 4.0.9-3.54.1.
EPSS: 0.004 (33.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.3 (Critical). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Suse Manager_server — versions 4.1, 3.2, 4.0
- Suse Salt-netapi-client
- Suse Linux Enterprise Module For Manager Server 4.1 — versions salt-netapi-client
- Suse Manager Server 3.2 — versions salt-netapi-client
- Suse Manager Server 4.0 — versions salt-netapi-client
Weakness classification (CWE)
References
- meissner@suse.de (x_refsource_CONFIRM, Exploit, Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-8028?
- CVE-2020-8028 is a critical-severity vulnerability in SUSE Manager Server, classified under Improper Access Control. CVSS score: 9.3/10. Published 2020-09-17.
- How severe is CVE-2020-8028?
- Critical severity. CVSS v3 base score is 9.3 out of 10.