CVE-2018-17957: suse repository_mirroring_tool
CVSS: 7.8v3.0HighModified
AliasesSUSE-SU-2018:4209-1
Published 26-12-2018Last modified 16-09-2024
Vulnerability summary
CVE-2018-17957 is a high (CVSS 7.8) vulnerability in suse repository_mirroring_tool. EPSS estimates a 0.38% chance of exploitation in the next 30 days, higher than 29.9% of scored vulnerabilities.
CVSS score
7.8/10
010
High · v3.0 (NVD)EPSS score
0.38%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 26-12-2018PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
The YaST2 RMT module for configuring the SUSE Repository Mirroring Tool (RMT) before 1.1.2 exposed MySQL database passwords on process commandline, allowing local attackers to access or corrupt the RMT database.
CVSS metrics
3 scores · 2 sources · 2 versionsHigh 7.8Preferred score · NVD (NIST)
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSources2 sources · 3.4–7.8
- CVE.orgCNA3.4LowCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:NDiffers
Low 2.1Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
0.38%
Chance of exploitation in the next 30 days
Percentile
30%
Versus all other CVEs
30-day change
0.00 pp
From 0.38% on 18-09-2026
18-09-202618-10-2026
EPSS score0.38%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-214Invocation of Process Using Visible Sensitive InformationA process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.
- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Affected systems
Suse3 products
- yast2-rmt&distro=SUSE Linux Enterprise Module for Server Applications 15< 1.1.2-3.11.1
- repository_mirroring_tool< 1.1.2
- yast2-rmt≥ unspecified, < 1.1.2
1 vendor · 3 products
References
5 links- lists.opensuse.org/opensuse-security-announce/2018-12/msg00068.htmlX Refsource CONFIRM
- bugzilla.suse.com/show_bug.cgi?id=1117602X Refsource CONFIRM