title: mysql-systemd-helper allows setting 640 permissions of arbitrary files
description: A UNIX Symbolic Link (Symlink) Following vulnerability in the mysql-systemd-helper of the mariadb packaging of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allows local attackers to change the permissions of arbitrary files to 0640. This issue affects: SUSE Linux Enterprise Server 12 mariadb versions prior to 10.2.31-3.25.1. SUSE Linux Enterprise Server 15 mariadb versions prior to 10.2.31-3.26.1.
problem types: CWE-59: Improper Link Resolution Before File Access ('Link Following')
affected:
{
product: SUSE Linux Enterprise Server 12
vendor: SUSE
versions:
lessThan: 10.2.31-3.25.1, status: affected, version: mariadb, versionType: custom
}
{
product: SUSE Linux Enterprise Server 15
vendor: SUSE
versions:
lessThan: 10.2.31-3.26.1, status: affected, version: mariadb, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 5.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
version: 3.1
]