← Back

CVE-2021-25314

nvd nist
Published: Apr 14, 2021Modified: Jun 17, 2026

JSON object

Loading...
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: NVD

Description

A Creation of Temporary File With Insecure Permissions vulnerability in hawk2 of SUSE Linux Enterprise High Availability 12-SP3, SUSE Linux Enterprise High Availability 12-SP5, SUSE Linux Enterprise High Availability 15-SP2 allows local attackers to escalate to root. This issue affects: SUSE Linux Enterprise High Availability 12-SP3 hawk2 versions prior to 2.6.3+git.1614685906.812c31e9. SUSE Linux Enterprise High Availability 12-SP5 hawk2 versions prior to 2.6.3+git.1614685906.812c31e9. SUSE Linux Enterprise High Availability 15-SP2 hawk2 versions prior to 2.6.3+git.1614684118.af555ad9.

Affected (3)

Products: Suse: Hawk2
Suse
1 product
Hawk2
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Hawk2
Before 2.6.3\+git.1614685906.812c31e9-2.42.1
Running on/withPlatform Versions
Suse
Linux Enterprise High Availability Extension
Version 12 sp3
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Hawk2
Before 2.6.3\+git.1614684118.af555ad9
Running on/withPlatform Versions
Suse
Linux Enterprise High Availability Extension
Version 15 sp2
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Hawk2
Before 2.6.3\+git.1614685906.812c31e9
Running on/withPlatform Versions
Suse
Linux Enterprise High Availability Extension
Version 12 sp5

Related CWEs

CWE-378
Creation of Temporary File With Insecure Permissions
Opening temporary files without appropriate measures or controls can leave the file, its contents and any function that it impacts vulnerable to attack.
CWE-668
Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.

References (2)

Source: meissner@suse.de
ExploitIssue TrackingVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitIssue TrackingVendor Advisory

Timeline

No history available yet.