title: Local privilege escalation from user news to root in the packaging of inn
description: The packaging of inn on SUSE Linux Enterprise Server 11; openSUSE Factory, Leap 15.1 allows local attackers to escalate from user inn to root via symlink attacks. This issue affects: SUSE Linux Enterprise Server 11 inn version 2.4.2-170.21.3.1 and prior versions. openSUSE Factory inn version 2.6.2-2.2 and prior versions. openSUSE Leap 15.1 inn version 2.5.4-lp151.2.47 and prior versions.
problem types: CWE-59: Improper Link Resolution Before File Access ('Link Following')
affected:
{
product: SUSE Linux Enterprise Server 11
vendor: SUSE
versions:
lessThanOrEqual: 2.4.2-170.21.3.1, status: affected, version: inn, versionType: custom
}
{
product: Factory
vendor: openSUSE
versions:
lessThanOrEqual: 2.6.2-2.2, status: affected, version: inn, versionType: custom
}
{
product: Leap 15.1
vendor: openSUSE
versions:
lessThanOrEqual: 2.5.4-lp151.2.47, status: affected, version: inn, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 7.7
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
]