CVE-2019-18900: medium-severity vulnerability in SUSE CaaS Platform 3.0
libzypp stores cookies world readable
Published · Updated
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4epss 0.3%
exploitation probability
0.3%top 76% of all CVEs
observed exploitation
nono source reports it
: Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed local attackers to read a cookie store used by libzypp, exposing private cookies. This issue affects: SUSE CaaS Platform 3.0 libzypp versions prior to 16.21.2-27.68.1. SUSE Linux Enterprise Server 12 libzypp versions prior to 16.21.2-2.45.1. SUSE Linux Enterprise Server 15 17.19.0-3.34.1.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
SUSE · CaaS Platform 3.0SUSE · SUSE Linux Enterprise Server 12SUSE · SUSE Linux Enterprise Server 15Related CVEs — SUSE CaaS Platform 3.0
In the same product, most dangerous first.
CVE-2019-18903HIGHwicked: Use-after-free when receiving invalid DHCP6 IA_PD optionEPSS 2.4%CVE-2019-18902HIGHwicked: Use-after-free when receiving invalid DHCP6 client optionsEPSS 2.4%CVE-2019-3689MEDIUMnfs-utils: root-owned files stored in insecure /var/lib/nfs directoryEPSS 1.5%CVE-2018-12476MEDIUMobs-service-extract_file's outfilename parameter allows to write files outside of package directoryEPSS 1.0%CVE-2019-18905MEDIUMDeprecated functionality in autoyast2 automatically imports gpg keys without checking themEPSS 0.7%CVE-2019-3698MEDIUMnagios cron job allows privilege escalation from user nagios to rootEPSS 0.7%