3.3

CVE-2021-25317: fedoraproject fedora Incorrect Default Permissions

CVSS: 3.3v3.1LowModified
AliasesSUSE-SU-2021:1453-1SUSE-SU-2021:1454-1SUSE-SU-2021:14712-1
Published 05-05-2021Last modified 08-10-2026
Open JSON

Vulnerability summary

CVE-2021-25317 is a low (CVSS 3.3) Incorrect Default Permissions vulnerability in fedoraproject fedora. EPSS estimates a 0.27% chance of exploitation in the next 30 days, higher than 17.6% of scored vulnerabilities.

Overall risk
13/100
0100
Low · default modelHow is this calculated?
CVSS score
3.3/10
010
Low · v3.1 (CVE.org)
EPSS score
0.27%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2024:10707-1

Timeline

  1. 05-05-2021
    PublishedVulnerability first disclosed.
  2. 08-10-2026
    Last modifiedVulnerability information updated.

Description

A Incorrect Default Permissions vulnerability in the packaging of cups of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Leap 15.2, Factory allows local attackers with control of the lp users to create files as root with 0644 permissions without the ability to set the content. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS cups versions prior to 1.3.9. SUSE Manager Server 4.0 cups versions prior to 2.2.7. SUSE OpenStack Cloud Crowbar 9 cups versions prior to 1.7.5. openSUSE Leap 15.2 cups versions prior to 2.2.7. openSUSE Factory cups version 2.3.3op2-2.1 and prior versions.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

0.27%

Chance of exploitation in the next 30 days

Percentile

18%

Versus all other CVEs

30-day change

0.00 pp

From 0.27% on 18-09-2026

18-09-202618-10-2026
EPSS score
0.27%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse35 products
  • cups&distro=HPE Helion OpenStack 8< 1.7.5-20.36.1
  • cups&distro=SUSE Enterprise Storage 6< 2.2.7-3.26.1
  • cups&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS< 2.2.7-3.26.1
  • cups&distro=SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS< 2.2.7-3.26.1
  • cups&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS< 2.2.7-3.26.1
Opensuse3 products
Fedoraproject1 product

3 vendors · 39 products

References

10 links