CVE-2019-3698 — MEDIUM (5.7)

Q: How severe is CVE-2019-3698?

CVE-2019-3698 has been rated MEDIUM with a CVSS base score of 5.7/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2019-3698?

Check the references section above for vendor advisories and patch information. Affected products include: Nagios Nagios, Suse Linux Enterprise Server, Opensuse Backports Sle, Opensuse Leap.

Vulnerability Description

UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11; openSUSE Factory allows local attackers to cause cause DoS or potentially escalate privileges by winning a race. This issue affects: SUSE Linux Enterprise Server 12 nagios version 3.5.1-5.27 and prior versions. SUSE Linux Enterprise Server 11 nagios version 3.0.6-1.25.36.3.1 and prior versions. openSUSE Factory nagios version 4.4.5-2.1 and prior versions.

CVSS Score

5.7

MEDIUM

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

LOW

Affected Products

Vendor	Product	Versions
Nagios	Nagios	< 3.5.1
Suse	Linux Enterprise Server	12
Opensuse	Backports Sle	15.0
Opensuse	Leap	15.1

Related Weaknesses (CWE)

CWE-59

References

http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00014.htmlMailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00022.htmlMailing ListThird Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1156309ExploitIssue TrackingPatch
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00014.htmlMailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00022.htmlMailing ListThird Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1156309ExploitIssue TrackingPatch

FAQ

What is CVE-2019-3698?

CVE-2019-3698 is a vulnerability with a CVSS score of 5.7 (MEDIUM). UNIX Symbolic Link (Symlink) Following vulnerability in the cronjob shipped with nagios of SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 11; openSUSE Factory allows local attackers to ...

How severe is CVE-2019-3698?

CVE-2019-3698 has been rated MEDIUM with a CVSS base score of 5.7/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2019-3698?

Check the references section above for vendor advisories and patch information. Affected products include: Nagios Nagios, Suse Linux Enterprise Server, Opensuse Backports Sle, Opensuse Leap.