9.3

CVE-2020-8028: suse salt-netapi-client Improper Access Control

CVSS: 9.3v3.1CriticalModified
AliasesSUSE-SU-2020:2647-1SUSE-SU-2020:2648-1
Published 17-09-2020Last modified 17-09-2024
Open JSON

Vulnerability summary

CVE-2020-8028 is a critical (CVSS 9.3) Improper Access Control vulnerability in suse salt-netapi-client. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 33% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
70/100
0100
High · default modelHow is this calculated?
CVSS score
9.3/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.40%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
SUSE-SU-2020:2650-1

Timeline

  1. 17-09-2020
    PublishedVulnerability first disclosed.
  2. 17-09-2024
    Last modifiedVulnerability information updated.

Description

A Improper Access Control vulnerability in the configuration of salt of SUSE Linux Enterprise Module for SUSE Manager Server 4.1, SUSE Manager Proxy 4.0, SUSE Manager Retail Branch Server 4.0, SUSE Manager Server 3.2, SUSE Manager Server 4.0 allows local users to escalate to root on every system managed by SUSE manager. On the managing node itself code can be executed as user salt, potentially allowing for escalation to root there. This issue affects: SUSE Linux Enterprise Module for SUSE Manager Server 4.1 google-gson versions prior to 2.8.5-3.4.3, httpcomponents-client-4.5.6-3.4.2, httpcomponents-. SUSE Manager Proxy 4.0 release-notes-susemanager-proxy versions prior to 4.0.9-0.16.38.1. SUSE Manager Retail Branch Server 4.0 release-notes-susemanager-proxy versions prior to 4.0.9-0.16.38.1. SUSE Manager Server 3.2 salt-netapi-client versions prior to 0.16.0-4.14.1, spacewalk-. SUSE Manager Server 4.0 release-notes-susemanager versions prior to 4.0.9-3.54.1.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

0.40%

Chance of exploitation in the next 30 days

Percentile

33%

Versus all other CVEs

30-day change

0.00 pp

From 0.40% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.40%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (bugzilla.suse.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Suse15 products
  • google-gson&distro=SUSE Manager Server Module 4.1< 2.8.5-3.4.3
  • httpcomponents-client&distro=SUSE Manager Server Module 4.1< 4.5.6-3.4.2
  • httpcomponents-core&distro=SUSE Manager Server Module 4.1< 4.4.10-3.4.2
  • salt-netapi-client&distro=SUSE Manager Server 3.2< 0.16.0-4.14.1
  • salt-netapi-client&distro=SUSE Manager Server Module 4.1< 0.17.0-3.3.2

1 vendor · 15 products

References

5 links