7.8

CVE-2020-8022: apache tomcat Incorrect Default Permissions

CVSS: 7.8v3.1HighModified
AliasesSUSE-SU-2020:1788-1SUSE-SU-2020:1789-1SUSE-SU-2020:1790-1
Published 29-06-2020Last modified 08-10-2026
Open JSON

Vulnerability summary

CVE-2020-8022 is a high (CVSS 7.8) Incorrect Default Permissions vulnerability in apache tomcat. EPSS estimates a 0.86% chance of exploitation in the next 30 days, higher than 57.6% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
41/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.1 (NVD)
EPSS score
0.86%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 0 · Related 2
CGA-96VV-PFGJ-64GFCGA-J493-R58R-JHQG

Timeline

  1. 29-06-2020
    PublishedVulnerability first disclosed.
  2. 08-10-2026
    Last modifiedVulnerability information updated.

Description

A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8 allows local attackers to escalate from group tomcat to root. This issue affects: SUSE Enterprise Storage 5 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP2-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-BCL tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP3-LTSS tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server 12-SP4 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 12-SP5 tomcat versions prior to 9.0.35-3.39.1. SUSE Linux Enterprise Server 15-LTSS tomcat versions prior to 9.0.35-3.57.3. SUSE Linux Enterprise Server for SAP 12-SP2 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 12-SP3 tomcat versions prior to 8.0.53-29.32.1. SUSE Linux Enterprise Server for SAP 15 tomcat versions prior to 9.0.35-3.57.3. SUSE OpenStack Cloud 7 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud 8 tomcat versions prior to 8.0.53-29.32.1. SUSE OpenStack Cloud Crowbar 8 tomcat versions prior to 8.0.53-29.32.1.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.86%

Chance of exploitation in the next 30 days

Percentile

58%

Versus all other CVEs

30-day change

0.00 pp

From 0.86% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.86%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (bugzilla.suse.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Suse34 products
  • tomcat&distro=HPE Helion OpenStack 8< 8.0.53-29.32.1
  • tomcat&distro=SUSE Enterprise Storage 5< 8.0.53-29.32.1
  • tomcat&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS< 9.0.35-3.57.3
  • tomcat&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS< 9.0.35-3.57.3
  • tomcat&distro=SUSE Linux Enterprise Module for Web and Scripting 15 SP1< 9.0.35-4.35.1
Opensuse2 products
  • leapEOL15.1
  • tomcat&distro=openSUSE Leap 15.1< 9.0.35-lp151.3.21.1
Apache1 product
  • tomcat< 8.0.53-29.32.1 | < 9.0.35-3.39.1 | < 9.0.35-3.57.3
Chainguard1 product
  • tomcat-8.5.87All versions (No fix recorded)
Org.apache.tomcat1 product
  • tomcat< 8.0.53 | ≥ 9.0.0, < 9.0.35

5 vendors · 39 products

References

18 links
Show all 18 references