CVE-2020-8026 json
inn: non-root owned files
published 2020-08-07 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-28938
- cvss
- 8.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 30%
- public exploits
- 0
- none known
Summary
A Incorrect Default Permissions vulnerability in the packaging of inn in openSUSE Leap 15.2, openSUSE Tumbleweed, openSUSE Leap 15.1 allows local attackers with control of the new user to escalate their privileges to root. This issue affects: openSUSE Leap 15.2 inn version 2.6.2-lp152.1.26 and prior versions. openSUSE Tumbleweed inn version 2.6.2-4.2 and prior versions. openSUSE Leap 15.1 inn version 2.5.4-lp151.3.3.1 and prior versions.
Patch / fix
- inn Package Hub 15 SP2 2.6.2-bp152.2.4.1
- inn Package Hub 15 SP1 2.5.4-bp151.4.6.1
- inn openSUSE Leap 15.2 2.6.2-lp152.2.3.1
- inn openSUSE Leap 15.1 2.5.4-lp151.3.6.1
opensuse advisories openSUSE-SU-2020:1427-1openSUSE-SU-2020:1304-1openSUSE-SU-2020:1272-1openSUSE-SU-2020:1271-1
Exploit prediction
0.36% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.4 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- openSUSE openSUSE Leap 15.2
- openSUSE openSUSE Tumbleweed
- openSUSE openSUSE Leap 15.1
Classification
- Weakness
-
- CWE-276 Incorrect Default Permissions
References
-
lists.opensuse.org
/opensuse-security-announce/2020-08/msg00064.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2020-08/msg00063.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2020-08/msg00074.html
vendor-advisory, mailing-list, third-party-advisory
-
lists.opensuse.org
/opensuse-security-announce/2020-09/msg00038.html
vendor-advisory, mailing-list, third-party-advisory
-
bugzilla.suse.com
/show_bug.cgi?id=1172573
issue-tracking, vendor-advisory
Sources
- CVE List CVE-2020-8026
- NVD CVE-2020-8026
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.