CVE-2020-8028

CRITICAL Year: 2020
CVSS v3 Score
9.3
Critical
CVSS v2 Score
7.2
High
Weakness Type
CWE-284
View all →

Vulnerability Description

A Improper Access Control vulnerability in the configuration of salt of SUSE Linux Enterprise Module for SUSE Manager Server 4.1, SUSE Manager Proxy 4.0, SUSE Manager Retail Branch Server 4.0, SUSE Manager Server 3.2, SUSE Manager Server 4.0 allows local users to escalate to root on every system managed by SUSE manager. On the managing node itself code can be executed as user salt, potentially allowing for escalation to root there. This issue affects: SUSE Linux Enterprise Module for SUSE Manager Server 4.1 google-gson versions prior to 2.8.5-3.4.3, httpcomponents-client-4.5.6-3.4.2, httpcomponents-. SUSE Manager Proxy 4.0 release-notes-susemanager-proxy versions prior to 4.0.9-0.16.38.1. SUSE Manager Retail Branch Server 4.0 release-notes-susemanager-proxy versions prior to 4.0.9-0.16.38.1. SUSE Manager Server 3.2 salt-netapi-client versions prior to 0.16.0-4.14.1, spacewalk-. SUSE Manager Server 4.0 release-notes-susemanager versions prior to 4.0.9-3.54.1.

Related Vulnerabilities

CVE-2016-0088

CRITICAL
CVSS:9.3(Critical)

Hyper-V in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows guest OS users to execute arbitrary code on the host OS via a crafted application, aka "Hyper-V Remote Code Exe...

CWE-2842016

CVE-2022-27185

CRITICAL
CVSS:9.3(Critical)

A denial of service vulnerability exists in the confctl_set_master_wlan functionality of TCL LinkHub Mesh Wifi MS1G_00_01.00_14. A specially-crafted network packet can lead to denial of service. An at...

CWE-2842022

CVE-2022-27660

CRITICAL
CVSS:9.3(Critical)

A denial of service vulnerability exists in the confctl_set_guest_wlan functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted network packet can lead to denial of service. An at...

CWE-2842022

CVE-2024-21364

CRITICAL
CVSS:9.3(Critical)

Microsoft Azure Site Recovery Elevation of Privilege Vulnerability

CWE-2842024

CVE-2024-40766

CRITICAL
CVSS:9.3(Critical)

An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized resource access and in specific conditions, causing the fir...

CWE-2842024

CVE-2024-11167

CRITICAL
CVSS:9.4(Critical)

An improper access control vulnerability in danny-avila/librechat versions prior to 0.7.6 allows authenticated users to delete other users' prompts via the groupid parameter. This issue occurs because...

CWE-2842024