CVE-2020-7040: canonical ubuntu_linux Link Following
CVSS: 9.3v2.0HighModified
AliasesopenSUSE-SU-2020:0119-1UBUNTU-CVE-2020-7040USN-4508-1DEBIAN-CVE-2020-7040DLA-2095-1openSUSE-SU-2024:11410-1
Published 21-01-2020Last modified 04-08-2024
Vulnerability summary
CVE-2020-7040 is a high (CVSS 9.3) Link Following vulnerability in canonical ubuntu_linux. EPSS estimates a 2.87% chance of exploitation in the next 30 days, higher than 86.5% of scored vulnerabilities.
CVSS score
9.3/10
010
High · v2.0 (NVD)EPSS score
2.87%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 21-01-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
storeBackup.pl in storeBackup through 3.5 relies on the /tmp/storeBackup.lock pathname, which allows symlink attacks that possibly lead to privilege escalation. (Local users can also create a plain file named /tmp/storeBackup.lock to block use of storeBackup until an admin manually deletes that file.)
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 8.1Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.1HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
High 9.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:C/I:C/A:CSourcesSingle source
EPSS trend
Probability
2.87%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
0.00 pp
From 2.87% on 19-09-2026
19-09-202619-10-2026
EPSS score2.87%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Opensuse4 products
- backports_sle15.0 | 15.0:sp1
- leapEOL15.1
- storeBackup&distro=openSUSE Leap 15.1< 3.5-bp151.4.3.1
- storeBackup&distro=openSUSE Tumbleweed< 3.5-13.2
Debian2 products
- storebackup< 3.2.1-2 | < 3.2.1-1+deb8u1
- debian_linuxEOL8.0
Suse2 products
- storeBackup&distro=SUSE Package Hub 15< 3.5-bp151.4.3.1
- storeBackup&distro=SUSE Package Hub 15 SP1< 3.5-bp151.4.3.1
Canonical1 product
- ubuntu_linuxEOL16.04 | 18.04 | 20.04
Storebackup1 product
- storebackup≤ 3.5
Ubuntu1 product
- storebackup< 3.2.1-1+deb8u1build0.16.04.1 | < 3.2.1-1+deb8u1build0.18.04.1 | < 3.2.1-1+deb8u1build0.20.04.1
6 vendors · 11 products
References
18 links- lists.opensuse.org/opensuse-security-announce/2020-01/msg00054.htmlVendor AdvisoryX Refsource SUSEMailing ListPatchThird Party Advisory
lists.debian.org/debian-lts-announce/2020/02/msg00003.htmlMailing ListX Refsource MLISTThird Party Advisory
Show all 18 references
- lists.opensuse.org/archives/…Advisory