CVE-2020-15397: hylafax\+_project hylafax\+
Vulnerability summary
CVE-2020-15397 is a high (CVSS 7.8) vulnerability in hylafax\+_project hylafax\+. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 44.1% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 6 · Related 5Timeline
- 30-06-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
HylaFAX+ through 7.0.2 and HylaFAX Enterprise have scripts that execute binaries from directories writable by unprivileged users (e.g., locations under /var/spool/hylafax that are writable by the uucp account). This allows these users to execute code in the context of the user calling these binaries (often root).
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · AlpineEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.54%
Chance of exploitation in the next 30 days
Percentile
44%
Versus all other CVEs
30-day change
0.00 pp
From 0.54% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (bugzilla.suse.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- hylafaxplus< 7.0.0-r4 | < 7.0.1-r2 | < 7.0.2-r2 | < 7.0.0-r1
Hylafax\+_project1 product
- hylafax\+≤ 7.0.2
Ifax1 product
Ubuntu1 product
- hylafaxAll versions (No fix recorded)
4 vendors · 4 products