title: inn: non-root owned files
description: A Incorrect Default Permissions vulnerability in the packaging of inn in openSUSE Leap 15.2, openSUSE Tumbleweed, openSUSE Leap 15.1 allows local attackers with control of the new user to escalate their privileges to root. This issue affects: openSUSE Leap 15.2 inn version 2.6.2-lp152.1.26 and prior versions. openSUSE Tumbleweed inn version 2.6.2-4.2 and prior versions. openSUSE Leap 15.1 inn version 2.5.4-lp151.3.3.1 and prior versions.
problem types: CWE-276: Incorrect Default Permissions
affected:
{
product: openSUSE Leap 15.2
vendor: openSUSE
versions:
lessThanOrEqual: 2.6.2-lp152.1.26, status: affected, version: inn, versionType: custom
}
{
product: openSUSE Tumbleweed
vendor: openSUSE
versions:
lessThanOrEqual: 2.6.2-4.2, status: affected, version: inn, versionType: custom
}
{
product: openSUSE Leap 15.1
vendor: openSUSE
versions:
lessThanOrEqual: 2.5.4-lp151.3.3.1, status: affected, version: inn, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]