CVE-2018-19638: opensuse supportutils Insecure Temporary File
CVSS: 4.7v3.0MediumModified
Published 05-03-2019Last modified 17-09-2024
Vulnerability summary
CVE-2018-19638 is a medium (CVSS 4.7) Insecure Temporary File vulnerability in opensuse supportutils. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 32.6% of scored vulnerabilities.
CVSS score
4.7/10
010
Medium · v3.0 (NVD)EPSS score
0.40%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 4 · Related 4Timeline
- 05-03-2019PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
In supportutils, before version 3.1-5.7.1 and if pacemaker is installed on the system, an unprivileged user could have overwritten arbitrary files in the directory that is used by supportutils to collect the log files.
CVSS metrics
3 scores · 2 sources · 2 versionsMedium 4.7Preferred score · NVD (NIST)
CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:NSources2 sources · 2.2–4.7
- CVE.orgCNA2.2LowCVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:NDiffers
Low 3.3Preferred score · NVD (NIST)
AV:L/AC:M/Au:N/C:N/I:P/A:PSourcesSingle source
EPSS trend
Probability
0.40%
Chance of exploitation in the next 30 days
Percentile
33%
Versus all other CVEs
30-day change
0.00 pp
From 0.40% on 18-09-2026
18-09-202618-10-2026
EPSS score0.40%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-377Insecure Temporary FileCreating and using insecure temporary files can leave application and system data vulnerable to attack.
- CWE-59Improper Link Resolution Before File Access ('Link Following')The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
Affected systems
Opensuse1 product
- supportutils< 3.1-5.7.1
Suse1 product
- supportutils≥ unspecified, < 3.1-5.7.1
2 vendors · 2 products
References
2 links- bugzilla.suse.com/show_bug.cgi?id=1118460X Refsource CONFIRM